3 skills found
patrickfav / HkdfA standalone Java 7 implementation of HMAC-based key derivation function (HKDF) defined in RFC 5869 first described by Hugo Krawczyk. HKDF follows the "extract-then-expand" paradigm which is compatible to NIST 800-56C Rev. 1 two step KDF
Rastaman4e / 1NICEHASH PLATFORM TERMS OF USE AND NICEHASH MINING TERMS OF SERVICE PLEASE READ THESE NICEHASH PLATFORM TERMS OF USE AND NICEHASH MINING TERMS OF SERVICE (“Terms”) CAREFULLY BEFORE USING THE THE PLATFORM OR SERVICES DESCRIBED HEREIN. BY SELECTING “I AGREE”, ACCESSING THE PLATFORM, USING NICEHASH MINING SERVICES OR DOWNLOADING OR USING NICEHASH MINING SOFTWARE, YOU ARE ACKNOWLEDGING THAT YOU HAVE READ THESE TERMS, AS AMENDED FROM TIME TO TIME, AND YOU ARE AGREEING TO BE BOUND BY THEM. IF YOU DO NOT AGREE TO THESE TERMS, OR ANY SUBSEQUENT AMENDMENTS, CHANGES OR UPDATES, DO NOT ACCESS THE PLATFORM, USE NICEHASH MINING SERVICES OR USE THE NICEHASH MINING SOFTWARE. GENERAL These Terms apply to users of the NiceHash Platform (“Platform” and NiceHash Mining Services (“Services”) which are provided to you by NICEHASH Ltd, company organized and existing under the laws of the British Virgin Islands, with registered address at Intershore Chambers, Road Town, Tortola, British Virgin Islands, registration number: 2048669, hereinafter referred to as “NiceHash, as well as “we” or “us”. ELIGIBILITY By using the NiceHash platform and NiceHash Mining Services, you represent and warrant that you: are at least Minimum Age and have capacity to form a binding contract; have not previously been suspended or removed from the NiceHash Platform; have full power and authority to enter into this agreement and in doing so will not violate any other agreement to which you are a party; are not not furthering, performing, undertaking, engaging in, aiding, or abetting any unlawful activity through your relationship with us, through your use of NiceHash Platform or use of NiceHash Mining Services; will not use NiceHash Platform or NiceHash Mining Services if any applicable laws in your country prohibit you from doing so in accordance with these Terms. We reserve the right to terminate your access to the NiceHash Platform and Mining Services for any reason and in our sole and absolute discretion. Use of NiceHash Platform and Mining Services is void where prohibited by applicable law. Depending on your country of residence or incorporation or registered office, you may not be able to use all the functions of the NiceHash Platform or services provided therein. It is your responsibility to follow the rules and laws in your country of residence and/or country from which you access the NiceHash Platform. DEFINITIONS NiceHash Platform means a website located on the following web address: www.nicehash.com. NiceHash Mining Services mean all services provided by NiceHash, namely the provision of the NiceHash Platform, NiceHash Hashing power marketplace, NiceHash API, NiceHash OS, NiceHash Mining Software including licence for NiceHash Miner, NiceHash Private Endpoint, NiceHash Account, NiceHash mobile apps, and all other software products, applications and services associated with these products, except for the provision of NiceHash Exchange Services. NiceHash Exchange Service means a service which allows trading of digital assets in the form of digital tokens or cryptographic currency for our users by offering them a trading venue, helping them find a trading counterparty and providing the means for transaction execution. NiceHash Exchange Services are provided by NICEX Ltd and accessible at the NiceHash Platform under NiceHash Exchange Terms of Service. Hashing power marketplace means an infrastructure provided by the NiceHash which enables the Hashing power providers to point their rigs towards NiceHash stratum servers where Hashing power provided by different Hashing power providers is gathered and sold as generic Hashing power to the Hashing power buyers. Hashing power buyer means a legal entity or individual who buys the gathered and generic hashing power on the Hashing power marketplace from undefined Hashing power providers. Hashing power provider means a legal entity or individual who sells his hashing power on the Hashing power marketplace to undefined Hashing power buyers. NiceHash Mining Software means NiceHash Miner and any other software available via the NiceHash Platform. NiceHash Miner means a comprehensive software with graphical user interface and web interface, owned by NiceHash. NiceHash Miner is a process manager software which enables the Hashing power providers to point their rigs towards NiceHash stratum servers and sell their hashing power to the Hashing power buyers. NiceHash Miner also means any and all of its code, compilations, updates, upgrades, modifications, error corrections, patches and bug fixes and similar. NiceHash Miner does not mean third party software compatible with NiceHash Miner (Third Party Plugins and Miners). NiceHash QuickMiner means a software accessible at https://www.nicehash.com/quick-miner which enables Hashing power providers to point their PCs or rigs towards NiceHash stratum servers and sell their hashing power to the Hashing power buyers. NiceHash QuickMiner is intended as a tryout tool. Hashing power rig means all hardware which produces hashing power that represents computation power which is required to calculate the hash function of different type of cryptocurrency. Secondary account is an account managed by third party from which the Account holder deposits funds to his NiceHash Wallet or/and to which the Account holder withdraws funds from his NiceHash Wallet. Stratum is a lightweight mining protocol: https://slushpool.com/help/manual/stratum-protocol. NiceHash Account means an online account available on the NiceHash Platform and created by completing the registration procedure on the NiceHash Platform. Account holder means an individual or legal entity who completes the registration procedure and successfully creates the NiceHash Account. Minimum Age means 18 years old or older, if in order for NiceHash to lawfully provide the Services to you without parental consent (including using your personal data). NiceHash Wallet means a wallet created automatically for the Account holder and provided by the NiceHash Wallet provider. NiceHash does not hold funds on behalf of the Account holder but only transfers Account holder’s requests regarding the NiceHash Wallet transaction to the NiceHash Wallet provider who executes the requested transactions. In this respect NiceHash only processes and performs administrative services related to the payments regarding the NiceHash Mining Services and NiceHash Exchange Services, if applicable. NiceHash Wallet provider is a third party which on the behalf of the Account holder provides and manages the NiceHash Wallet, holds, stores and transfers funds and hosts NiceHash Wallet. For more information about the NiceHash Wallet provider, see the following website: https://www.bitgo.com/. Blockchain network is a distributed database that is used to maintain a continuously growing list of records, called blocks. Force Majeure Event means any governmental or relevant regulatory regulations, acts of God, war, riot, civil commotion, fire, flood, or any disaster or an industrial dispute of workers unrelated to you or NiceHash. Any act, event, omission, happening or non-happening will only be considered Force Majeure if it is not attributable to the wilful act, neglect or failure to take reasonable precautions of the affected party, its agents, employees, consultants, contractors and sub-contractors. SALE AND PURCHASE OF HASHING POWER Hashing power providers agree to sell and NiceHash agrees to proceed Hashing power buyers’ payments for the provided hashing power on the Hashing power marketplace, on the Terms set forth herein. According to the applicable principle get-paid-per-valid-share (pay as you go principle) Hashing power providers will be paid only for validated and accepted hashing power to their NiceHash Wallet or other wallet, as indicated in Account holder’s profile settings or in stratum connection username. In some cases, no Hashing power is sent to Hashing power buyers or is accepted by NiceHash Services, even if Hashing power is generated on the Hashing power rigs. These cases include usage of slower hardware as well as software, hardware or network errors. In these cases, Hashing power providers are not paid for such Hashing power. Hashing power buyers agree to purchase and NiceHash agrees to process the order and forward the purchased hashing power on the Hashing power marketplace, on the Terms set forth herein. According to the applicable principle pay-per-valid-share (pay as you go principle) Hashing power buyers will pay from their NiceHash Wallet only for the hashing power that was validated by our engine. When connection to the mining pool which is selected on the Hashing power order is lost or when an order is cancelled during its lifetime, Hashing power buyer pays for additional 10 seconds worth of hashing power. Hashing power order is charged for extra hashing power when mining pool which is selected on the Hashing power order, generates rapid mining work changes and/or rapid mining job switching. All payments including any fees will be processed in crypto currency and NiceHash does not provide an option to sale and purchase of the hashing power in fiat currency. RISK DISCLOSURE If you choose to use NiceHash Platform, Services and NiceHash Wallet, it is important that you remain aware of the risks involved, that you have adequate technical resources and knowledge to bear such risks and that you monitor your transactions carefully. General risk You understand that NiceHash Platform and Services, blockchain technology, Bitcoin, all other cryptocurrencies and cryptotokens, proof of work concept and other associated and related technologies are new and untested and outside of NiceHash’s control. You acknowledge that there are major risks associated with these technologies. In addition to the risks disclosed below, there are risks that NiceHash cannot foresee and it is unreasonable to believe that such risk could have been foreseeable. The performance of NiceHash’s obligation under these Terms will terminate if market or technology circumstances change to such an extent that (i) these Terms clearly no longer comply with NiceHash’s expectations, (ii) it would be unjust to enforce NiceHash’s obligations in the general opinion or (iii) NiceHash’s obligation becomes impossible. NiceHash Account abuse You acknowledge that there is risk associated with the NiceHash Account abuse and that you have been fully informed and warned about it. The funds stored in the NiceHash Wallet may be disposed by third party in case the third party obtains the Account holder’s login credentials. The Account holder shall protect his login credentials and his electronic devices where the login credentials are stored against unauthorized access. Regulatory risks You acknowledge that there is risk associated with future legislation which may restrict, limit or prohibit certain aspects of blockchain technology which may also result in restriction, limitation or prohibition of NiceHash Services and that you have been fully informed and warned about it. Risk of hacking You acknowledge that there is risk associated with hacking NiceHash Services and NiceHash Wallet and that you have been fully informed and warned about it. Hacker or other groups or organizations may attempt to interfere with NiceHash Services or NiceHash Wallet in any way, including without limitation denial of services attacks, Sybil attacks, spoofing, smurfing, malware attacks, mining attacks or consensus-based attacks. Cryptocurrency risk You acknowledge that there is risk associated with the cryptocurrencies which are used as payment method and that you have been fully informed and warned about it. Cryptocurrencies are prone to, but not limited to, value volatility, transaction costs and times uncertainty, lack of liquidity, availability, regulatory restrictions, policy changes and security risks. NiceHash Wallet risk You acknowledge that there is risk associated with funds held on the NiceHash Wallet and that you have been fully informed and warned about it. You acknowledge that NiceHash Wallet is provided by NiceHash Wallet provider and not NiceHash. You acknowledge and agree that NiceHash shall not be responsible for any NiceHash Wallet provider’s services, including their accuracy, completeness, timeliness, validity, copyright compliance, legality, decency, quality or any other aspect thereof. NiceHash does not assume and shall not have any liability or responsibility to you or any other person or entity for any Hash Wallet provider’s services. Hash Wallet provider’s services and links thereto are provided solely as a convenience to you and you access and use them entirely at your own risk and subject to NiceHash Wallet provider’s terms and conditions. Since the NiceHash Wallet is a cryptocurrency wallet all funds held on it are entirely uninsured in contrast to the funds held on the bank account or other financial institutions which are insured. Connection risk You acknowledge that there are risks associated with usage of NiceHash Services which are provided through the internet including, but not limited to, the failure of hardware, software, configuration and internet connections and that you have been fully informed and warned about it. You acknowledge that NiceHash will not be responsible for any configuration, connection or communication failures, disruptions, errors, distortions or delays you may experience when using NiceHash Services, however caused. Hashing power provision risk You acknowledge that there are risks associated with the provisions of the hashing power which is provided by the Hashing power providers through the Hashing power marketplace and that you have been fully informed and warned about it. You acknowledge that NiceHash does not provide the hashing power but only provides the Hashing power marketplace as a service. Hashing power providers’ Hashing power rigs are new and untested and outside of NiceHash’s control. There is a major risk that the Hashing power rigs (i) will stop providing hashing power, (ii) will provide hashing power in an unstable way, (iii) will be wrongly configured or (iv) provide insufficient speed of the hashing power. Hashing power rigs as hardware could be subject of damage, errors, electricity outage, misconfiguration, connection or communication failures and other malfunctions. NiceHash will not be responsible for operation of Hashing power rigs and its provision of hashing power. By submitting a Hashing power order you agree to Hashing power no-refund policy – all shares forwarded to mining pool, selected on the Hashing power order are final and non-refundable. Hashing power profitability risk You acknowledge that there is risk associated with the profitability of the hashing power provision and that you have been fully informed and warned about it. You acknowledge that all Hashing power rig’s earning estimates and profitability calculations on NiceHash Platform are only for informational purposes and were made based on the Hashing power rigs set up in the test environments. NiceHash does not warrant that your Hashing power rigs would achieve the same profitability or earnings as calculated on NiceHash Platform. There is risk that your Hashing power rig would not produce desired hashing power quantity and quality and that your produced hashing power would differentiate from the hashing power produced by our Hashing power rigs set up in the test environments. There is risk that your Hashing power rigs would not be as profitable as our Hashing power rigs set up in the test environments or would not be profitable at all. WARRANTIES NiceHash Platform and Mining Services are provided on the “AS IS” and “AS AVAILABLE” basis, including all faults and defects. To the maximum extent permitted by applicable law, NiceHash makes no representations and warranties and you waive all warranties of any kind. Particularly, without limiting the generality of the foregoing, the NiceHash makes no representations and warranties, whether express, implied, statutory or otherwise regarding NiceHash Platform and Mining Services or other services related to NiceHash Platform and provided by third parties, including any warranty that such services will be uninterrupted, harmless, secure or not corrupt or damaged, meet your requirements, achieve any intended results, be compatible or work with any other software, applications, systems or services, meet any performance or error free or that any errors or defects can or will be corrected. Additionally NiceHash makes no representations and warranties, whether express, implied, statutory or otherwise of merchantability, suitability, reliability, availability, timeliness, accuracy, satisfactory quality, fitness for a particular purpose or quality, title and non-infringement with respect to any of the Mining Services or other services related to NiceHash Platform and provided by third parties, or quiet enjoyment and any warranties arising out of any course of dealing, course of performance, trade practice or usage of NiceHash Platform and Mining Services including information, content and material contained therein. Especially NiceHash makes no representations and warranties, whether express, implied, statutory or otherwise regarding any payment services and systems, NiceHash Wallet which is provided by third party or any other financial services which might be related to the NiceHash Platform and Mining Services. You acknowledge that you do not rely on and have not been induced to accept the NiceHash Platform and Mining Services according to these Terms on the basis of any warranties, representations, covenants, undertakings or any other statement whatsoever, other than expressly set out in these Terms that neither the NiceHash nor any of its respective agents, officers, employees or advisers have given any such warranties, representations, covenants, undertakings or other statements. LIABILITY NiceHash and their respective officers, employees or agents will not be liable to you or anyone else, to the maximum extent permitted by applicable law, for any damages of any kind, including, but not limited to, direct, consequential, incidental, special or indirect damages (including but not limited to lost profits, trading losses or damages that result from use or loss of use of NiceHash Services or NiceHash Wallet), even if NiceHash has been advised of the possibility of such damages or losses, including, without limitation, from the use or attempted use of NiceHash Platform and Mining Services, NiceHash Wallet or other related websites or services. NiceHash does not assume any obligations to users in connection with the unlawful alienation of Bitcoins, which occurred on 6. 12. 2017 with NICEHASH, d. o. o., and has been fully reimbursed with the completion of the NiceHash Repayment Program. NiceHash will not be responsible for any compensation, reimbursement, or damages arising in connection with: (i) your inability to use the NiceHash Platform and Mining Services, including without limitation as a result of any termination or suspension of the NiceHash Platform or these Terms, power outages, maintenance, defects, system failures, mistakes, omissions, errors, defects, viruses, delays in operation or transmission or any failure of performance, (ii) the cost of procurement of substitute goods or services, (iii) any your investments, expenditures, or commitments in connection with these Terms or your use of or access to the NiceHash Platform and Mining Services, (iv) your reliance on any information obtained from NiceHash, (v) Force Majeure Event, communications failure, theft or other interruptions or (vi) any unauthorized access, alteration, deletion, destruction, damage, loss or failure to store any data, including records, private key or other credentials, associated with NiceHash Platform and Mining Services or NiceHash Wallet. Our aggregate liability (including our directors, members, employees and agents), whether in contract, warranty, tort (including negligence, whether active, passive or imputed), product liability, strict liability or other theory, arising out of or relating to the use of NiceHash Platform and Mining Services, or inability to use the Platform and Services under these Terms or under any other document or agreement executed and delivered in connection herewith or contemplated hereby, shall in any event not exceed 100 EUR per user. You will defend, indemnify, and hold NiceHash harmless and all respective employees, officers, directors, and representatives from and against any claims, demand, action, damages, loss, liabilities, costs and expenses (including reasonable attorney fees) arising out of or relating to (i) any third-party claim concerning these Terms, (ii) your use of, or conduct in connection with, NiceHash Platform and Mining Services, (iii) any feedback you provide, (iv) your violation of these Terms, (v) or your violation of any rights of any other person or entity. If you are obligated to indemnify us, we will have the right, in our sole discretion, to control any action or proceeding (at our expense) and determine whether we wish to settle it. If we are obligated to respond to a third-party subpoena or other compulsory legal order or process described above, you will also reimburse us for reasonable attorney fees, as well as our employees’ and contractors’ time and materials spent responding to the third-party subpoena or other compulsory legal order or process at reasonable hourly rates. The Services and the information, products, and services included in or available through the NiceHash Platform may include inaccuracies or typographical errors. Changes are periodically added to the information herein. Improvements or changes on the NiceHash Platform can be made at any time. NICEHASH ACCOUNT The registration of the NiceHash Account is made through the NiceHash Platform, where you are required to enter your email address and password in the registration form. After successful completion of registration, the confirmation email is sent to you. After you confirm your registration by clicking on the link in the confirmation email the NiceHash Account is created. NiceHash will send you proof of completed registration once the process is completed. When you create NiceHash Account, you agree to (i) create a strong password that you change frequently and do not use for any other website, (ii) implement reasonable and appropriate measures designed to secure access to any device which has access to your email address associated with your NiceHash Account and your username and password for your NiceHash Account, (iii) maintain the security of your NiceHash Account by protecting your password and by restricting access to your NiceHash Account; (iv) promptly notify us if you discover or otherwise suspect any security breaches related to your NiceHash Account so we can take all required and possible measures to secure your NiceHash Account and (v) take responsibility for all activities that occur under your NiceHash Account and accept all risks of any authorized or unauthorized access to your NiceHash Account, to the maximum extent permitted by law. Losing access to your email, registered at NiceHash Platform, may also mean losing access to your NiceHash Account. You may not be able to use the NiceHash Platform or Mining Services, execute withdrawals and other security sensitive operations until you regain access to your email address, registered at NiceHash Platform. If you wish to change the email address linked to your NiceHash Account, we may ask you to complete a KYC procedure for security purposes. This step serves solely for the purpose of identification in the process of regaining access to your NiceHash Account. Once the NiceHash Account is created a NiceHash Wallet is automatically created for the NiceHash Account when the request for the first deposit to the NiceHash Wallet is made by the user. Account holder’s NiceHash Wallet is generated by NiceHash Wallet provider. Account holder is strongly suggested to enhance the security of his NiceHash Account by adding an additional security step of Two-factor authentication (hereinafter “2FA”) when logging into his account, withdrawing funds from his NiceHash Wallet or placing a new order. Account holder can enable this security feature in the settings of his NiceHash Account. In the event of losing or changing 2FA code, we may ask the Account holder to complete a KYC procedure for security reasons. This step serves solely for the purpose of identification in the process of reactivating Account holders 2FA and it may be subject to an a In order to use certain functionalities of the NiceHash Platform, such as paying for the acquired hashing power, users must deposit funds to the NiceHash Wallet, as the payments for the hashing power could be made only through NiceHash Wallet. Hashing power providers have two options to get paid for the provided hashing power: (i) by using NiceHash Wallet to receive the payments or (ii) by providing other Bitcoin address where the payments shall be received to. Hashing power providers provide their Bitcoin address to NiceHash by providing such details via Account holder’s profile settings or in a form of a stratum username while connecting to NiceHash stratum servers. Account holder may load funds on his NiceHash Wallet from his Secondary account. Account holder may be charged fees by the Secondary account provider or by the blockchain network for such transaction. NiceHash is not responsible for any fees charged by Secondary account providers or by the blockchain network or for the management and security of the Secondary accounts. Account holder is solely responsible for his use of Secondary accounts and Account holder agrees to comply with all terms and conditions applicable to any Secondary accounts. The timing associated with a load transaction will depend in part upon the performance of Secondary accounts providers, the performance of blockchain network and performance of the NiceHash Wallet provider. NiceHash makes no guarantee regarding the amount of time it may take to load funds on to NiceHash Wallet. NiceHash Wallet shall not be used by Account holders to keep, save and hold funds for longer period and also not for executing other transactions which are not related to the transactions regarding the NiceHash Platform. The NiceHash Wallet shall be used exclusively and only for current and ongoing transactions regarding the NiceHash Platform. Account holders shall promptly withdraw any funds kept on the NiceHash Wallet that will not be used and are not intended for the reasons described earlier. Commission fees may be charged by the NiceHash Wallet provider, by the blockchain network or by NiceHash for any NiceHash Wallet transactions. Please refer to the NiceHash Platform, for more information about the commission fees for NiceHash Wallet transactions which are applicable at the time of the transaction. NiceHash reserves the right to change these commission fees according to the provisions to change these Terms at any time for any reason. You have the right to use the NiceHash Account only in compliance with these Terms and other commercial terms and principles published on the NiceHash Platform. In particular, you must observe all regulations aimed at ensuring the security of funds and financial transactions. Provided that the balance of funds in your NiceHash Wallet is greater than any minimum balance requirements needed to satisfy any of your open orders, you may withdraw from your NiceHash Wallet any amount of funds, up to the total amount of funds in your NiceHash Wallet in excess of such minimum balance requirements, to Secondary Account, less any applicable withdrawal fees charged by NiceHash or by the blockchain network for such transaction. Withdrawals are not processed instantly and may be grouped with other withdrawal requests. Some withdrawals may require additional verification information which you will have to provide in order to process the withdrawal. It may take up to 24 hours before withdrawal is fully processed and distributed to the Blockchain network. Please refer to the NiceHash Platform for more information about the withdrawal fees and withdrawal processing. NiceHash reserves the right to change these fees according to the provisions to change these Terms at any time for any reason. You have the right to close the NiceHash Account. In case you have funds on your NiceHash Wallet you should withdraw funds from your account prior to requesting NiceHash Account closure. After we receive your NiceHash Account closure request we will deactivate your NiceHash Account. You can read more about closing the NiceHash Account in our Privacy Policy. Your NiceHash Account may be deactivated due to your inactivity. Your NiceHash account may be locked and a mandatory KYC procedure is applied for security reasons, if it has been more than 6 month since your last login. NiceHash or any of its partners or affiliates are not responsible for the loss of the funds, stored on or transferred from the NiceHash Wallet, as well as for the erroneous implementation of the transactions made via NiceHash Wallet, where such loss or faulty implementation of the transaction are the result of a malfunction of the NiceHash Wallet and the malfunction was caused by you or the NiceHash Wallet provider. You are obliged to inform NiceHash in case of loss or theft, as well as in the case of any possible misuse of the access data to your NiceHash Account, without any delay, and demand change of access data or closure of your existing NiceHash Account and submit a request for new access data. NiceHash will execute the change of access data or closure of the NiceHash Account and the opening of new NiceHash Account as soon as technically possible and without any undue delay. All information pertaining to registration, including a registration form, generation of NiceHash Wallet and detailed instructions on the use of the NiceHash Account and NiceHash Wallet are available at NiceHash Platform. The registration form as well as the entire system is properly protected from unwanted interference by third parties. KYC PROCEDURE NiceHash is appropriately implementing AML/CTF and security measures to diligently detect and prevent any malicious or unlawful use of NiceHash Services or use, which is strictly prohibited by these Terms, which are deemed as your agreement to provide required personal information for identity verification. Security measures include a KYC procedure, which is aimed at determining the identity of an individual user or an organisation. We may ask you to complete this procedure before enabling some or all functionalities of the NiceHash platform and provide its services. A KYC procedure might be applied as a security measure when: changing the email address linked to your NiceHash Account, losing or changing your 2FA code; logging in to your NiceHash Account for the first time after the launch of the new NiceHash Platform in August 2019, gaining access to all or a portion of NiceHash Services, NiceHash Wallet and its related services or any portion thereof if they were disabled due to and activating your NiceHash Account if it has been deactivated due to its inactivity and/or security or other reasons. HASHING POWER TRANSACTIONS General NiceHash may, at any time and in our sole discretion, (i) refuse any order submitted or provided hashing power, (ii) cancel an order or part of the order before it is executed, (iii) impose limits on the order amount permitted or on provided hashing power or (iv) impose any other conditions or restrictions upon your use of the NiceHash Platform and Mining Services without prior notice. For example, but not limited to, NiceHash may limit the number of open orders that you may establish or limit the type of supported Hashing power rigs and mining algorithms or NiceHash may restrict submitting orders or providing hashing power from certain locations. Please refer to the NiceHash Platform, for more information about terminology, hashing power transactions’ definitions and descriptions, order types, order submission, order procedure, order rules and other restrictions and limitations of the hashing power transactions. NiceHash reserves the right to change any transaction, definitions, description, order types, procedure, rules, restrictions and limitations at any time for any reason. Orders, provision of hashing power, payments, deposits, withdrawals and other transactions are accepted only through the interface of the NiceHash Platform, NiceHash API and NiceHash Account and are fixed by the software and hardware tools of the NiceHash Platform. If you do not understand the meaning of any transaction option, NiceHash strongly encourages you not to utilize any of those options. Hashing Power Order In order to submit an Hashing Power Order via the NiceHash Account, the Hashing power buyer must have available funds in his NiceHash Wallet. Hashing power buyer submits a new order to buy hashing power via the NiceHash Platform or via the NiceHash API by setting the following parameters in the order form: NiceHash service server location, third-party mining pool, algorithm to use, order type, set amount he is willing to spend on this order, set price per hash he is willing to pay, optionally approximate limit maximum hashing power for his order and other parameters as requested and by confirming his order. Hashing power buyer may submit an order in maximum amount of funds available on his NiceHash Wallet at the time of order submission. Order run time is only approximate since order’s lifetime is based on the number of hashes that it delivers. Particularly during periods of high volume, illiquidity, fast movement or volatility in the marketplace for any digital assets or hashing power, the actual price per hash at which some of the orders are executed may be different from the prevailing price indicated on NiceHash Platform at the time of your order. You understand that NiceHash is not liable for any such price fluctuations. In the event of market disruption, NiceHash Services disruption, NiceHash Hashing Power Marketplace disruption or manipulation or Force Majeure Event, NiceHash may do one or more of the following: (i) suspend access to the NiceHash Account or NiceHash Platform, or (ii) prevent you from completing any actions in the NiceHash Account, including closing any open orders. Following any such event, when trading resumes, you acknowledge that prevailing market prices may differ significantly from the prices available prior to such event. When Hashing power buyer submits an order for purchasing of the Hashing power via NiceHash Platform or via the NiceHash API he authorizes NiceHash to execute the order on his behalf and for his account in accordance with such order. Hashing power buyer acknowledges and agrees that NiceHash is not acting as his broker, intermediary, agent or advisor or in any fiduciary capacity. NiceHash executes the order in set order amount minus NiceHash’s processing fee. Once the order is successfully submitted the order amount starts to decrease in real time according to the payments for the provided hashing power. Hashing power buyer agrees to pay applicable processing fee to NiceHash for provided services. The NiceHash’s fees are deducted from Hashing power buyer’s NiceHash Wallet once the whole order is exhausted and completed. Please refer to the NiceHash Platform, for more information about the fees which are applicable at the time of provision of services. NiceHash reserves the right to change these fees according to the provisions to change these Terms at any time for any reason. The changed fees will apply only for the NiceHash Services provided after the change of the fees. All orders submitted prior the fee change but not necessary completed prior the fee change will be charged according to the fees applicable at the time of the submission of the order. NiceHash will attempt, on a commercially reasonable basis, to execute the Hashing power buyer’s purchase of the hashing power on the Hashing power marketplace under these Terms according to the best-effort delivery approach. In this respect NiceHash does not guarantee that the hashing power will actually be delivered or verified and does not guarantee any quality of the NiceHash Services. Hashing power buyer may cancel a submitted order during order’s lifetime. If an order has been partially executed, Hashing power buyer may cancel the unexecuted remainder of the order. In this case the NiceHash’s processing fee will apply only for the partially executed order. NiceHash reserves the right to refuse any order cancellation request once the order has been submitted. Selling Hashing Power and the Provision of Hashing Power In order to submit the hashing power to the NiceHash stratum server the Hashing power provider must first point its Hashing power rig to the NiceHash stratum server. Hashing power provider is solely responsible for configuration of his Hashing power rig. The Hashing power provider gets paid by Hashing power buyers for all validated and accepted work that his Hashing power rig has produced. The provided hashing power is validated by NiceHash’s stratum engine and validator. Once the hashing power is validated the Hashing power provider is entitled to receive the payment for his work. NiceHash logs all validated hashing power which was submitted by the Hashing power provider. The Hashing power provider receives the payments of current globally weighted average price on to his NiceHash Wallet or his selected personal Bitcoin address. The payments are made periodically depending on the height of payments. NiceHash reserves the right to hold the payments any time and for any reason by indicating the reason, especially if the payments represent smaller values. Please refer to the NiceHash Platform, for more information about the height of payments for provided hashing power, how the current globally weighted average price is calculated, payment periods, payment conditions and conditions for detention of payments. NiceHash reserves the right to change this payment policy according to the provisions to change these Terms at any time for any reason. All Hashing power rig’s earnings and profitability calculations on NiceHash Platform are only for informational purposes. NiceHash does not warrant that your Hashing power rigs would achieve the same profitability or earnings as calculated on NiceHash Platform. You hereby acknowledge that it is possible that your Hashing power rigs would not be as profitable as indicated in our informational calculations or would not be profitable at all. Hashing power provider agrees to pay applicable processing fee to NiceHash for provided Services. The NiceHash’s fees are deducted from all the payments made to the Hashing power provider for his provided work. Please refer to the NiceHash Platform, for more information about the fees which are applicable at the time of provision of services. Hashing power provider which has not submitted any hashing power to the NiceHash stratum server for a period of 90 days agrees that a processing fee of 0.00001000 BTC or less, depending on the unpaid mining balance, will be deducted from his unpaid mining balance. NiceHash reserves the right to change these fees according to the provisions to change these Terms at any time for any reason. The changed fees will apply only for the NiceHash Services provided after the change of the fees. NiceHash will attempt, on a commercially reasonable basis, to execute the provision of Hashing power providers’ hashing power on the Hashing power marketplace under these Terms according to the best-effort delivery approach. In this respect NiceHash does not guarantee that the hashing power will actually be delivered or verified and does not guarantee any quality of the NiceHash Services. Hashing power provider may disconnect the Hashing power rig from the NiceHash stratum server any time. NiceHash reserves the right to refuse any Hashing power rig once the Hashing power rig has been pointed towards NiceHash stratum server. RESTRICTIONS When accessing the NiceHash Platform or using the Mining Services or NiceHash Wallet, you warrant and agree that you: will not use the Services for any purpose that is unlawful or prohibited by these Terms, will not violate any law, contract, intellectual property or other third-party right or commit a tort, are solely responsible for your conduct while accessing the NiceHash Platform or using the Mining Services or NiceHash Wallet, will not access the NiceHash Platform or use the Mining Services in any manner that could damage, disable, overburden, or impair the provision of the Services or interfere with any other party's use and enjoyment of the Services, will not misuse and/or maliciously use Hashing power rigs, you will particularly refrain from using network botnets or using NiceHash Platform or Mining Services with Hashing power rigs without the knowledge or awareness of Hashing power rig owner(s), will not perform or attempt to perform any kind of malicious attacks on blockchains with the use of the NiceHash Platform or Mining Services, intended to maliciously gain control of more than 50% of the network's mining hash rate, will not use the NiceHash Platform or Mining Services for any kind of market manipulation or disruption, such as but not limited to NiceHash Mining Services disruption and NiceHash Hashing Power Marketplace manipulation. In case of any of the above mentioned events, NiceHash reserves the right to immediately suspend your NiceHash Account, freeze or block the funds in the NiceHash Wallet, and suspend your access to NiceHash Platform, particularly if NiceHash believes that such NiceHash Account are in violation of these Terms or Privacy Policy, or any applicable laws and regulation. RIGHTS AND OBLIGATIONS In the event of disputes with you, NiceHash is obliged to prove that the NiceHash service which is the subject of the dispute was not influenced by technical or other failure. You will have possibility to check at any time, subject to technical availability, the transactions details, statistics and available balance of the funds held on the NiceHash Wallet, through access to the NiceHash Account. You may not obtain or attempt to obtain any materials or information through any means not intentionally made available or provided to you or public through the NiceHash Platform or Mining Services. We may, in our sole discretion, at any time, for any or no reason and without liability to you, with prior notice (i) terminate all rights and obligations between you and NiceHash derived from these Terms, (ii) suspend your access to all or a portion of NiceHash Services, NiceHash Wallet and its related services or any portion thereof and delete or deactivate your NiceHash Account and all related information and files in such account (iii) modify, suspend or discontinue, temporarily or permanently, any portion of NiceHash Platform or (iv) provide enhancements or improvements to the features and functionality of the NiceHash Platform, which may include patches, bug fixes, updates, upgrades and other modifications. Any such change may modify or delete certain portion, features or functionalities of the NiceHash Services. You agree that NiceHash has no obligation to (i) provide any updates, or (ii) continue to provide or enable any particular portion, features or functionalities of the NiceHash Services to you. You further agree that all changes will be (i) deemed to constitute an integral part of the NiceHash Platform, and (ii) subject to these Terms. In the event of your breach of these Terms, including but not limited to, for instance, in the event that you breach any term of these Terms, due to legal grounds originating in anti-money laundering and know your client regulation and procedures, or any other relevant applicable regulation, all right and obligations between you and NiceHash derived from these Terms terminate automatically if you fail to comply with these Terms within the notice period of 8 days after you have been warned by NiceHash about the breach and given 8 days period to cure the breaches. NiceHash reserves the right to keep these rights and obligations in force despite your breach of these Terms. In the event of termination, NiceHash will attempt to return you any funds stored on your NiceHash Wallet not otherwise owed to NiceHash, unless NiceHash believes you have committed fraud, negligence or other misconduct. You acknowledge that the NiceHash Services and NiceHash Wallet may be suspended for maintenance. Technical information about the hashing power transactions, including information about chosen server locations, algorithms used, selected mining pools, your business or activities, including all financial and technical information, specifications, technology together with all details of prices, current transaction performance and future business strategy represent confidential information and trade secrets. NiceHash shall, preserve the confidentiality of all before mentioned information and shall not disclose or cause or permit to be disclosed without your permission any of these information to any person save to the extent that such disclosure is strictly to enable you to perform or comply with any of your obligations under these Terms, or to the extent that there is an irresistible legal requirement on you or NiceHash to do so; or where the information has come into the public domain otherwise than through a breach of any of the terms of these Terms. NiceHash shall not be entitled to make use of any of these confidential information and trade secrets other than during the continuance of and pursuant to these Terms and then only for the purpose of carrying out its obligations pursuant to these Terms. NICEHASH MINER LICENSE (NICEHASH MINING SOFTWARE LICENSE) NiceHash Mining Software whether on disk, in read only memory, or any other media or in any other form is licensed, not sold, to you by NiceHash for use only under these Terms. NiceHash retains ownership of the NiceHash Mining Software itself and reserves all rights not expressly granted to you. Subject to these Terms, you are granted a limited, non-transferable, non-exclusive and a revocable license to download, install and use the NiceHash Mining Software. You may not distribute or make the NiceHash Mining Software available over a network where it could be used by multiple devices at the same time. You may not rent, lease, lend, sell, redistribute, assign, sublicense host, outsource, disclose or otherwise commercially exploit the NiceHash Mining Software or make it available to any third party. There is no license fee for the NiceHash Mining Software. NiceHash reserves the right to change the license fee policy according to the provisions to change these Terms any time and for any reason, including to decide to start charging the license fee for the NiceHash Mining Software. You are responsible for any and all applicable taxes. You may not, and you agree not to or enable others to, copy, decompile, reverse engineer, reverse compile, disassemble, attempt to derive the source code of, decrypt, modify, or create derivative works of the NiceHash Mining Software or any services provided by the NiceHash Mining Software, or any part thereof (except as and only to the extent any foregoing restriction is prohibited by applicable law or to the extent as may be permitted by the licensing terms governing use of open-sourced components included with the NiceHash Mining Software). If you choose to allow automatic updates, your device will periodically check with NiceHash for updates and upgrades to the NiceHash Mining Software and, if an update or upgrade is available, the update or upgrade will automatically download and install onto your device and, if applicable, your peripheral devices. You can turn off the automatic updates altogether at any time by changing the automatic updates settings found within the NiceHash Mining Software. You agree that NiceHash may collect and use technical and related information, including but not limited to technical information about your computer, system and application software, and peripherals, that is gathered periodically to facilitate the provision of software updates, product support and other services to you (if any) related to the NiceHash Mining Software and to verify compliance with these Terms. NiceHash may use this information, as long as it is in a form that does not personally identify you, to improve our NiceHash Services. NiceHash Mining Software contains features that rely upon information about your selected mining pools. You agree to our transmission, collection, maintenance, processing, and use of all information obtained from you about your selected mining pools. You can opt out at any time by going to settings in the NiceHash Mining Software. NiceHash may provide interest-based advertising to you. If you do not want to receive relevant ads in the NiceHash Mining Software, you can opt out at any time by going to settings in the NiceHash Mining Software. If you opt out, you will continue to receive the same number of ads, but they may be less relevant because they will not be based on your interest. NiceHash Mining Software license is effective until terminated. All provisions of these Terms regarding the termination apply also for the NiceHash Mining Software license. Upon the termination of NiceHash Mining Software license, you shall cease all use of the NiceHash Mining Software and destroy or delete all copies, full or partial, of the NiceHash Mining Software. THIRD PARTY MINERS AND PLUGINS Third Party Miners and Plugins are a third party software which enables the best and most efficient mining operations. NiceHash Miner integrates third party mining software using a third party miner plugin system. Third Party Mining Software is a closed source software which supports mining algorithms for cryptocurrencies and can be integrated into NiceHash Mining Software. Third Party Miner Plugin enables the connection between NiceHash Mining Software and Third Party Mining Software and it can be closed, as well as open sourced. NiceHash Mining Software user interface enables the user to manually select which available Third Party Miners and Plugins will be downloaded and integrated. Users can select or deselect Third Party Miners and Plugins found in the Plugin Manager window. Some of the available Third Party Miners and Plugins which are most common are preselected by NiceHash, but can be deselected, depending on users' needs. The details of the Third Party Miners and Plugins available for NiceHash Mining Software are accessible within the NiceHash Mining Software user interface. The details include, but not limited to, the author of the software and applicable license information, if applicable information about developer fee for Third Party Miners, software version etc. Developer fees may apply to the use of Third Party Miners and Plugins. NiceHash will not be liable, to the maximum extent permitted by applicable law, for any damages of any kind, including, but not limited to, direct, consequential, incidental, special or indirect damages, arising out of using Third Party Miners and Plugins. The latter includes, but is not limited to: i) any power outages, maintenance, defects, system failures, mistakes, omissions, errors, defects, viruses, delays in operation or transmission or any failure of performance; ii) any unauthorized access, alteration, deletion, destruction, damage, loss or failure to store any data, including records, private key or other credentials, associated with usage of Third Party Miners and Plugins and ii) Force Majeure Event, communications failure, theft or other interruptions. If you choose to allow automatic updates, your device will periodically check with NiceHash for updates and upgrades to the installed Third Party Miners and Plugins, if an update or upgrade is available, the update or upgrade will automatically download and install onto your device and, if applicable, your peripheral devices. You can turn off the automatic updates altogether at any time by changing the automatic updates settings found within the NiceHash Mining Software. NICEHASH QUICKMINER NiceHash QuickMiner is a software application that allows the visitors of the NiceHash Quick Miner web page, accessible athttps://www.nicehash.com/quick-miner, to connect their PC or a mining rig to the NiceHash Hashing Power Marketplace. Visitors of the NiceHash Quick Miner web page can try out and experience crypto currency mining without having to register on the NiceHash Platform and create a NiceHash Account. Users are encouraged to do so as soon as possible in order to collect the funds earned using NiceHash Quick Miner. Users can download NiceHash QuickMiner free of charge. In order to operate NiceHash QuickMiner software needs to automatically detect technical information about users' computer hardware. You agree that NiceHash may collect and use technical and related information. For more information please refer to NiceHash Privacy Policy. Funds arising from the usage of NiceHash QuickMiner are transferred to a dedicated cryptocurrency wallet owned and managed by NiceHash. NiceHash QuickMiner Users expressly agree and acknowledge that completing the registration process and creating a NiceHash Account is necessary in order to collect the funds arising from the usage of NiceHash QuickMiner. Users of NiceHash QuickMiner who do not successfully register a NiceHash Account will lose their right to claim funds arising from their usage of NiceHash QuickMiner. Those funds, in addition to the condition that the user has not been active on the NiceHash QuickMiner web page for consecutive 7 days, will be donated to the charity of choice. NICEHASH PRIVATE ENDPOINT NiceHash Private Endpoint is a network interface that connects users privately and securely to NiceHash Stratum servers. Private Endpoint uses a private IP address and avoids additional latency caused by DDOS protection. All NiceHash Private Mining Proxy servers are managed by NiceHash and kept up-to-date. Users can request a dedicated private access endpoint by filling in the form for NiceHash Private Endpoint Solution available at the NiceHash Platform. In the form the user specifies the email address, country, number of connections and locations and algorithms used. Based on the request NiceHash prepares an individualized offer based on the pricing stipulated on the NiceHash Platform, available at https://www.nicehash.com/private-endpoint-solution. NiceHash may request additional information from the users of the Private Endpoint Solution in order to determine whether we are obligated to collect VAT from you, including your VAT identification number. INTELLECTUAL PROPERTY NiceHash retains all copyright and other intellectual property rights, including inventions, discoveries, knowhow, processes, marks, methods, compositions, formulae, techniques, information and data, whether or not patentable, copyrightable or protectable in trademark, and any trademarks, copyrights or patents based thereon over all content and other materials contained on NiceHash Platform or provided in connection with the Services, including, without limitation, the NiceHash logo and all designs, text, graphics, pictures, information, data, software, source code, as well as the compilation thereof, sound files, other files and the selection and arrangement thereof. This material is protected by international copyright laws and other intellectual property right laws, namely trademark. These Terms shall not be understood and interpreted in a way that they would mean assignment of copyright or other intellectual property rights, unless it is explicitly defined so in these Terms. NiceHash hereby grants you a limited, nonexclusive and non-sublicensable license to access and use NiceHash’s copyrighted work and other intellectual property for your personal or internal business use. Such license is subject to these Terms and does not permit any resale, the distribution, public performance or public display, modifying or otherwise making any derivative uses, use, publishing, transmission, reverse engineering, participation in the transfer or sale, or any way exploit any of the copyrighted work and other intellectual property other than for their intended purposes. This granted license will automatically terminate if NiceHash suspends or terminates your access to the Services, NiceHash Wallet or closes your NiceHash Account. NiceHash will own exclusive rights, including all intellectual property rights, to any feedback including, but not limited to, suggestions, ideas or other information or materials regarding NiceHash Services or related products that you provide, whether by email, posting through our NiceHash Platform, NiceHash Account or otherwise and you irrevocably assign any and all intellectual property rights on such feedback unlimited in time, scope and territory. Any Feedback you submit is non-confidential and shall become the sole property of NiceHash. NiceHash will be entitled to the unrestricted use, modification or dissemination of such feedback for any purpose, commercial or otherwise, without acknowledgment or compensation to you. You waive any rights you may have to the feedback. We have the right to remove any posting you make on NiceHash Platform if, in our opinion, your post does not comply with the content standards defined by these Terms. PRIVACY POLICY Please refer to our NiceHash Platform and Mining Services Privacy Policy published on the NiceHash Platform for information about how we collect, use and share your information, as well as what options do you have with regards to your personal information. COMMUNICATION AND SUPPORT You agree and consent to receive electronically all communications, agreements, documents, receipts, notices and disclosures that NiceHash provides in connection with your NiceHash Account or use of the NiceHash Platform and Services. You agree that NiceHash may provide these communications to you by posting them via the NiceHash Account or by emailing them to you at the email address you provide. You should maintain copies of electronic communications by printing a paper copy or saving an electronic copy. It is your responsibility to keep your email address updated in the NiceHash Account so that NiceHash can communicate with you electronically. You understand and agree that if NiceHash sends you an electronic communication but you do not receive it because your email address is incorrect, out of date, blocked by your service provider, or you are otherwise unable to receive electronic communications, it will be deemed that you have been provided with the communication. You can update your NiceHash Account preferences at any time by logging into your NiceHash Account. If your email address becomes invalid such that electronic communications sent to you by NiceHash are returned, NiceHash may deem your account to be inactive and close it. You may give NiceHash a notice under these Terms by sending an email to support@nicehash.com or contact NiceHash through support located on the NiceHash Platform. All communication and notices pursuant to these Terms must be given in English language. FEES Please refer to the NiceHash Platform for more information about the fees or administrative costs which are applicable at the time of provision of services. NiceHash reserves the right to change these fees according to the provisions to change these Terms at any time for any reason. The changed fees will apply only for the Services provided after the change of the fees. You authorize us, or our designated payment processor, to charge or deduct your NiceHash Account for any applicable fees in connection with the transactions completed via the Services. TAX It is your responsibility to determine what, if any, taxes apply to the transactions you complete or services you provide via the NiceHash Platform, Mining Services and NiceHash Wallet, it is your responsibility to report and remit the correct tax to the appropriate tax authority and all your factual and potential tax obligations are your concern. You agree that NiceHash is not in any case and under no conditions responsible for determining whether taxes apply to your transactions or services or for collecting, reporting, withholding or remitting any taxes arising from any transactions or services. You also agree that NiceHash is not in any case and under no conditions bound to compensate for your tax obligation or give you any advice related to tax issues. All fees and charges payable by you to NiceHash are exclusive of any taxes, and shall certain taxes be applicable, they shall be added on top of the payable amounts. Upon our request, you will provide to us any information that we reasonably request to determine whether we are obligated to collect VAT from you, including your VAT identification number. If any deduction or withholding is required by law, you will notify NiceHash and will pay NiceHash any additional amounts necessary to ensure that the net amount received by NiceHash, after any deduction and withholding, equals the amount NiceHash would have received if no deduction or withholding had been required. Additionally, you will provide NiceHash with documentation showing that the withheld and deducted amounts have been paid to the relevant taxing authority. FINAL PROVISIONS Natural persons and legal entities that are not capable of holding legal rights and obligations are not allowed to create NiceHash Account and use NiceHash Platform or other related services. If NiceHash becomes aware that such natural person or legal entity has created the NiceHash Account or has used NiceHash Services, NiceHash will delete such NiceHash Account and disable any Services and block access to NiceHash Account and NiceHash Services to such natural person or legal entity. If you register to use the NiceHash Services on behalf of a legal entity, you represent and warrant that (i) such legal entity is duly organized and validly existing under the applicable laws of the jurisdiction of its organization; and (ii) you are duly authorized by such legal entity to act on its behalf. These Terms do not create any third-party beneficiary rights in any individual or entity. These Terms forms the entire agreement and understanding relating to the subject matter hereof and supersede any previous and contemporaneous agreements, arrangements or understandings relating to the subject matter hereof to the exclusion of any terms implied by law that may be excluded by contract. If at any time any provision of these Terms is or becomes illegal, invalid or unenforceable, the legality, validity and enforceability of every other provisions will not in any way be impaired. Such illegal, invalid or unenforceable provision of these Terms shall be deemed to be modified and replaced by such legal, valid and enforceable provision or arrangement, which corresponds as closely as possible to our and your will and business purpose pursued and reflected in these Terms. Headings of sections are for convenience only and shall not be used to limit or construe such sections. No failure to enforce nor delay in enforcing, on our side to the Terms, any right or legal remedy shall function as a waiver thereof, nor shall any individual or partial exercise of any right or legal remedy prevent any further or other enforcement of these rights or legal remedies or the enforcement of any other rights or legal remedies. NiceHash reserves the right to make changes, amendments, supplementations or modifications from time to time to these Terms including but not limited to changes of licence agreement for NiceHash Mining Software and of any fees and compensations policies, in its sole discretion and for any reason. We suggest that you review these Terms periodically for changes. If we make changes to these Terms, we will provide you with notice of such changes, such as by sending an email, providing notice on the NiceHash Platform, placing a popup window after login to the NiceHash Account or by posting the amended Terms on the NiceHash Platform and updating the date at the top of these Terms. The amended Terms will be deemed effective immediately upon posting for any new users of the NiceHash Services. In all other cases, the amended Terms will become effective for preexisting users upon the earlier of either: (i) the date users click or press a button to accept such changes in their NiceHash Account, or (ii) continued use of NiceHash Services 30 days after NiceHash provides notice of such changes. Any amended Terms will apply prospectively to use of the NiceHash Services after such changes become effective. The notice of change of these Terms is considered as notice of termination of all rights and obligations between you and NiceHash derived from these Terms with notice period of 30 days, if you do not accept the amended Terms. If you do not agree to any amended Terms, (i) the agreement between you and NiceHash is terminated by expiry of 30 days period which starts after NiceHash provides you a notice of change of these Terms, (ii) you must discontinue using NiceHash Services and (iii) you must inform us regarding your disagreement with the changes and request closure of your NiceHash Account. If you do not inform us regarding your disagreement and do not request closure of you NiceHash Account, we will deem that you agree with the changed Terms. You may not assign or transfer your rights or obligations under these Terms without the prior written consent of NiceHash. NiceHash may assign or transfer any or all of its rights under these Terms, in whole or in part, without obtaining your consent or approval. These Terms shall be governed by and construed and enforced in accordance with the Laws of the British Virgin Islands, and shall be interpreted in all respects as a British Virgin Islands contract. Any transaction, dispute, controversy, claim or action arising from or related to your access or use of the NiceHash Platform or these Terms of Service likewise shall be governed by the Laws of the British Virgin Islands, exclusive of choice-of-law principles. The rights and remedies conferred on NiceHash by, or pursuant to, these Terms are cumulative and are in addition, and without prejudice, to all other rights and remedies otherwise available to NiceHash at law. NiceHash may transfer its rights and obligations under these Terms to other entities which include, but are not limited to H-BIT, d.o.o. and NICEX Ltd, or any other firm or business entity that directly or indirectly acquires all or substantially all of the assets or business of NICEHASH Ltd. If you do not consent to any transfer, you may terminate this agreement and close your NiceHash Account. These Terms are not boilerplate. If you disagree with any of them, believe that any should not apply to you, or wish to negotiate these Terms, please contact NiceHash and immediately navigate away from the NiceHash Platform. Do not use the NiceHash Mining Services, NiceHash Wallet or other related services until you and NiceHash have agreed upon new terms of service. Last updated: March 1, 2021
mercerheather476 / Turbo Garbanzo [](https://search.maven.org/search?q=g:net.openid%20appauth) [](http://javadoc.io/doc/net.openid/appauth) [](https://github.com/openid/AppAuth-Android/actions/workflows/build.yml) [](https://codecov.io/github/openid/AppAuth-Android?branch=master) AppAuth for Android is a client SDK for communicating with [OAuth 2.0](https://tools.ietf.org/html/rfc6749) and [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html) providers. It strives to directly map the requests and responses of those specifications, while following the idiomatic style of the implementation language. In addition to mapping the raw protocol flows, convenience methods are available to assist with common tasks like performing an action with fresh tokens. The library follows the best practices set out in [RFC 8252 - OAuth 2.0 for Native Apps](https://tools.ietf.org/html/rfc8252), including using [Custom Tabs](https://developer.chrome.com/multidevice/android/customtabs) for authorization requests. For this reason, `WebView` is explicitly *not* supported due to usability and security reasons. The library also supports the [PKCE](https://tools.ietf.org/html/rfc7636) extension to OAuth which was created to secure authorization codes in public clients when custom URI scheme redirects are used. The library is friendly to other extensions (standard or otherwise) with the ability to handle additional parameters in all protocol requests and responses. A talk providing an overview of using the library for enterprise single sign-on (produced by Google) can be found here: [Enterprise SSO with Chrome Custom Tabs](https://www.youtube.com/watch?v=DdQTXrk6YTk). ## Download AppAuth for Android is available on [MavenCentral](https://search.maven.org/search?q=g:net.openid%20appauth) ```groovy implementation 'net.openid:appauth:<version>' ``` ## Requirements AppAuth supports Android API 16 (Jellybean) and above. Browsers which provide a custom tabs implementation are preferred by the library, but not required. Both Custom URI Schemes (all supported versions of Android) and App Links (Android M / API 23+) can be used with the library. In general, AppAuth can work with any Authorization Server (AS) that supports native apps as documented in [RFC 8252](https://tools.ietf.org/html/rfc8252), either through custom URI scheme redirects, or App Links. AS's that assume all clients are web-based or require clients to maintain confidentiality of the client secrets may not work well. ## Demo app A demo app is contained within this repository. For instructions on how to build and configure this app, see the [demo app readme](https://github.com/openid/AppAuth-Android/blob/master/app/README.md). ## Conceptual overview AppAuth encapsulates the authorization state of the user in the [net.openid.appauth.AuthState](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/AuthState.java) class, and communicates with an authorization server through the use of the [net.openid.appauth.AuthorizationService](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/AuthorizationService.java) class. AuthState is designed to be easily persistable as a JSON string, using the storage mechanism of your choice (e.g. [SharedPreferences](https://developer.android.com/training/basics/data-storage/shared-preferences.html), [sqlite](https://developer.android.com/training/basics/data-storage/databases.html), or even just [in a file](https://developer.android.com/training/basics/data-storage/files.html)). AppAuth provides data classes which are intended to model the OAuth2 specification as closely as possible; this provides the greatest flexibility in interacting with a wide variety of OAuth2 and OpenID Connect implementations. Authorizing the user occurs via the user's web browser, and the request is described using instances of [AuthorizationRequest](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/AuthorizationRequest.java). The request is dispatched using [performAuthorizationRequest()](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/AuthorizationService.java#L159) on an AuthorizationService instance, and the response (an [AuthorizationResponse](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/AuthorizationResponse.java) instance) will be dispatched to the activity of your choice, expressed via an Intent. Token requests, such as obtaining a new access token using a refresh token, follow a similar pattern: [TokenRequest](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/TokenRequest.java) instances are dispatched using [performTokenRequest()](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/AuthorizationService.java#L252) on an AuthorizationService instance, and a [TokenResponse](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/TokenResponse.java) instance is returned via a callback. Responses can be provided to the [update()](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/AuthState.java#L367) methods on AuthState in order to track and persist changes to the authorization state. Once in an authorized state, the [performActionWithFreshTokens()](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/AuthState.java#L449) method on AuthState can be used to automatically refresh access tokens as necessary before performing actions that require valid tokens. ## Implementing the authorization code flow It is recommended that native apps use the [authorization code](https://tools.ietf.org/html/rfc6749#section-1.3.1) flow with a public client to gain authorization to access user data. This has the primary advantage for native clients that the authorization flow, which must occur in a browser, only needs to be performed once. This flow is effectively composed of four stages: 1. Discovering or specifying the endpoints to interact with the provider. 2. Authorizing the user, via a browser, in order to obtain an authorization code. 3. Exchanging the authorization code with the authorization server, to obtain a refresh token and/or ID token. 4. Using access tokens derived from the refresh token to interact with a resource server for further access to user data. At each step of the process, an AuthState instance can (optionally) be updated with the result to help with tracking the state of the flow. ### Authorization service configuration First, AppAuth must be instructed how to interact with the authorization service. This can be done either by directly creating an [AuthorizationServiceConfiguration](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/AuthorizationServiceConfiguration.java#L102) instance, or by retrieving an OpenID Connect discovery document. Directly specifying an AuthorizationServiceConfiguration involves providing the URIs of the authorization endpoint and token endpoint, and optionally a dynamic client registration endpoint (see "Dynamic client registration" for more info): ```java AuthorizationServiceConfiguration serviceConfig = new AuthorizationServiceConfiguration( Uri.parse("https://idp.example.com/auth"), // authorization endpoint Uri.parse("https://idp.example.com/token")); // token endpoint ``` Where available, using an OpenID Connect discovery document is preferable: ```java AuthorizationServiceConfiguration.fetchFromIssuer( Uri.parse("https://idp.example.com"), new AuthorizationServiceConfiguration.RetrieveConfigurationCallback() { public void onFetchConfigurationCompleted( @Nullable AuthorizationServiceConfiguration serviceConfiguration, @Nullable AuthorizationException ex) { if (ex != null) { Log.e(TAG, "failed to fetch configuration"); return; } // use serviceConfiguration as needed } }); ``` This will attempt to download a discovery document from the standard location under this base URI, `https://idp.example.com/.well-known/openid-configuration`. If the discovery document for your IDP is in some other non-standard location, you can instead provide the full URI as follows: ```java AuthorizationServiceConfiguration.fetchFromUrl( Uri.parse("https://idp.example.com/exampletenant/openid-config"), new AuthorizationServiceConfiguration.RetrieveConfigurationCallback() { ... } }); ``` If desired, this configuration can be used to seed an AuthState instance, to persist the configuration easily: ```java AuthState authState = new AuthState(serviceConfig); ``` ### Obtaining an authorization code An authorization code can now be acquired by constructing an AuthorizationRequest, using its Builder. In AppAuth, the builders for each data class accept the mandatory parameters via the builder constructor: ```java AuthorizationRequest.Builder authRequestBuilder = new AuthorizationRequest.Builder( serviceConfig, // the authorization service configuration MY_CLIENT_ID, // the client ID, typically pre-registered and static ResponseTypeValues.CODE, // the response_type value: we want a code MY_REDIRECT_URI); // the redirect URI to which the auth response is sent ``` Other optional parameters, such as the OAuth2 [scope string](https://tools.ietf.org/html/rfc6749#section-3.3) or OpenID Connect [login hint](http://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.2.1) are specified through set methods on the builder: ```java AuthorizationRequest authRequest = authRequestBuilder .setScope("openid email profile https://idp.example.com/custom-scope") .setLoginHint("jdoe@user.example.com") .build(); ``` This request can then be dispatched using one of two approaches. a `startActivityForResult` call using an Intent returned from the `AuthorizationService`, or by calling `performAuthorizationRequest` and providing pending intent for completion and cancelation handling activities. The `startActivityForResult` approach is simpler to use but may require more processing of the result: ```java private void doAuthorization() { AuthorizationService authService = new AuthorizationService(this); Intent authIntent = authService.getAuthorizationRequestIntent(authRequest); startActivityForResult(authIntent, RC_AUTH); } @Override protected void onActivityResult(int requestCode, int resultCode, Intent data) { if (requestCode == RC_AUTH) { AuthorizationResponse resp = AuthorizationResponse.fromIntent(data); AuthorizationException ex = AuthorizationException.fromIntent(data); // ... process the response or exception ... } else { // ... } } ``` If instead you wish to directly transition to another activity on completion or cancelation, you can use `performAuthorizationRequest`: ```java AuthorizationService authService = new AuthorizationService(this); authService.performAuthorizationRequest( authRequest, PendingIntent.getActivity(this, 0, new Intent(this, MyAuthCompleteActivity.class), 0), PendingIntent.getActivity(this, 0, new Intent(this, MyAuthCanceledActivity.class), 0)); ``` The intents may be customized to carry any additional data or flags required for the correct handling of the authorization response. #### Capturing the authorization redirect Once the authorization flow is completed in the browser, the authorization service will redirect to a URI specified as part of the authorization request, providing the response via query parameters. In order for your app to capture this response, it must register with the Android OS as a handler for this redirect URI. We recommend using a custom scheme based redirect URI (i.e. those of form `my.scheme:/path`), as this is the most widely supported across all versions of Android. To avoid conflicts with other apps, it is recommended to configure a distinct scheme using "reverse domain name notation". This can either match your service web domain (in reverse) e.g. `com.example.service` or your package name `com.example.app` or be something completely new as long as it's distinct enough. Using the package name of your app is quite common but it's not always possible if it contains illegal characters for URI schemes (like underscores) or if you already have another handler for that scheme - so just use something else. When a custom scheme is used, AppAuth can be easily configured to capture all redirects using this custom scheme through a manifest placeholder: ```groovy android.defaultConfig.manifestPlaceholders = [ 'appAuthRedirectScheme': 'com.example.app' ] ``` Alternatively, the redirect URI can be directly configured by adding an intent-filter for AppAuth's RedirectUriReceiverActivity to your AndroidManifest.xml: ```xml <activity android:name="net.openid.appauth.RedirectUriReceiverActivity" tools:node="replace"> <intent-filter> <action android:name="android.intent.action.VIEW"/> <category android:name="android.intent.category.DEFAULT"/> <category android:name="android.intent.category.BROWSABLE"/> <data android:scheme="com.example.app"/> </intent-filter> </activity> ``` If an HTTPS redirect URI is required instead of a custom scheme, the same approach (modifying your AndroidManifest.xml) is used: ```xml <activity android:name="net.openid.appauth.RedirectUriReceiverActivity" tools:node="replace"> <intent-filter> <action android:name="android.intent.action.VIEW"/> <category android:name="android.intent.category.DEFAULT"/> <category android:name="android.intent.category.BROWSABLE"/> <data android:scheme="https" android:host="app.example.com" android:path="/oauth2redirect"/> </intent-filter> </activity> ``` HTTPS redirects can be secured by configuring the redirect URI as an [app link](https://developer.android.com/training/app-links/index.html) in Android M and above. We recommend that a fallback page be configured at the same address to forward authorization responses to your app via a custom scheme, for older Android devices. #### Handling the authorization response Upon completion of the authorization flow, the completion Intent provided to performAuthorizationRequest will be triggered. The authorization response is provided to this activity via Intent extra data, which can be extracted using the `fromIntent()` methods on AuthorizationResponse and AuthorizationException respectively: ```java public void onCreate(Bundle b) { AuthorizationResponse resp = AuthorizationResponse.fromIntent(getIntent()); AuthorizationException ex = AuthorizationException.fromIntent(getIntent()); if (resp != null) { // authorization completed } else { // authorization failed, check ex for more details } // ... } ``` The response can be provided to the AuthState instance for easy persistence and further processing: ``` authState.update(resp, ex); ``` If the full redirect URI is required in order to extract additional information that AppAuth does not provide, this is also provided to your activity: ```java public void onCreate(Bundle b) { // ... Uri redirectUri = getIntent().getData(); // ... } ``` ### Exchanging the authorization code Given a successful authorization response carrying an authorization code, a token request can be made to exchange the code for a refresh token: ```java authService.performTokenRequest( resp.createTokenExchangeRequest(), new AuthorizationService.TokenResponseCallback() { @Override public void onTokenRequestCompleted( TokenResponse resp, AuthorizationException ex) { if (resp != null) { // exchange succeeded } else { // authorization failed, check ex for more details } } }); ``` The token response can also be used to update an AuthState instance: ```java authState.update(resp, ex); ``` ### Using access tokens Finally, the retrieved access token can be used to interact with a resource server. This can be done directly, by extracting the access token from a token response. However, in most cases, it is simpler to use the `performActionWithFreshTokens` utility method provided by AuthState: ```java authState.performActionWithFreshTokens(service, new AuthStateAction() { @Override public void execute( String accessToken, String idToken, AuthorizationException ex) { if (ex != null) { // negotiation for fresh tokens failed, check ex for more details return; } // use the access token to do something ... } }); ``` This also updates the AuthState object with current access, id, and refresh tokens. If you are storing your AuthState in persistent storage, you should write the updated copy in the callback to this method. ### Ending current session Given you have a logged in session and you want to end it. In that case you need to get: - `AuthorizationServiceConfiguration` - valid Open Id Token that you should get after authentication - End of session URI that should be provided within you OpenId service config First you have to build EndSessionRequest ```java EndSessionRequest endSessionRequest = new EndSessionRequest.Builder(authorizationServiceConfiguration) .setIdTokenHint(idToken) .setPostLogoutRedirectUri(endSessionRedirectUri) .build(); ``` This request can then be dispatched using one of two approaches. a `startActivityForResult` call using an Intent returned from the `AuthorizationService`, or by calling `performEndSessionRequest` and providing pending intent for completion and cancelation handling activities. The startActivityForResult approach is simpler to use but may require more processing of the result: ```java private void endSession() { AuthorizationService authService = new AuthorizationService(this); Intent endSessionItent = authService.getEndSessionRequestIntent(endSessionRequest); startActivityForResult(endSessionItent, RC_END_SESSION); } @Override protected void onActivityResult(int requestCode, int resultCode, Intent data) { if (requestCode == RC_END_SESSION) { EndSessionResonse resp = EndSessionResonse.fromIntent(data); AuthorizationException ex = AuthorizationException.fromIntent(data); // ... process the response or exception ... } else { // ... } } ``` If instead you wish to directly transition to another activity on completion or cancelation, you can use `performEndSessionRequest`: ```java AuthorizationService authService = new AuthorizationService(this); authService.performEndSessionRequest( endSessionRequest, PendingIntent.getActivity(this, 0, new Intent(this, MyAuthCompleteActivity.class), 0), PendingIntent.getActivity(this, 0, new Intent(this, MyAuthCanceledActivity.class), 0)); ``` End session flow will also work involving browser mechanism that is described in authorization mechanism session. Handling response mechanism with transition to another activity should be as follows: ```java public void onCreate(Bundle b) { EndSessionResponse resp = EndSessionResponse.fromIntent(getIntent()); AuthorizationException ex = AuthorizationException.fromIntent(getIntent()); if (resp != null) { // authorization completed } else { // authorization failed, check ex for more details } // ... } ``` ### AuthState persistence Instances of `AuthState` keep track of the authorization and token requests and responses. This is the only object that you need to persist to retain the authorization state of the session. Typically, one would do this by storing the authorization state in SharedPreferences or some other persistent store private to the app: ```java @NonNull public AuthState readAuthState() { SharedPreferences authPrefs = getSharedPreferences("auth", MODE_PRIVATE); String stateJson = authPrefs.getString("stateJson", null); if (stateJson != null) { return AuthState.jsonDeserialize(stateJson); } else { return new AuthState(); } } public void writeAuthState(@NonNull AuthState state) { SharedPreferences authPrefs = getSharedPreferences("auth", MODE_PRIVATE); authPrefs.edit() .putString("stateJson", state.jsonSerializeString()) .apply(); } ``` The demo app has an [AuthStateManager](https://github.com/openid/AppAuth-Android/blob/master/app/java/net/openid/appauthdemo/AuthStateManager.java) type which demonstrates this in more detail. ## Advanced configuration AppAuth provides some advanced configuration options via [AppAuthConfiguration](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/AppAuthConfiguration.java) instances, which can be provided to [AuthorizationService](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/AuthorizationService.java) during construction. ### Controlling which browser is used for authorization Some applications require explicit control over which browsers can be used for authorization - for example, to require that Chrome be used for second factor authentication to work, or require that some custom browser is used for authentication in an enterprise environment. Control over which browsers can be used can be achieved by defining a [BrowserMatcher](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/browser/BrowserMatcher.java), and supplying this to the builder of AppAuthConfiguration. A BrowserMatcher is suppled with a [BrowserDescriptor](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/browser/BrowserDescriptor.java) instance, and must decide whether this browser is permitted for the authorization flow. By default, [AnyBrowserMatcher](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/browser/AnyBrowserMatcher.java) is used. For your convenience, utility classes to help define a browser matcher are provided, such as: - [Browsers](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/browser/Browsers.java): contains a set of constants for the official package names and signatures of Chrome, Firefox and Samsung SBrowser. - [VersionedBrowserMatcher](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/browser/VersionedBrowserMatcher.java): will match a browser if it has a matching package name and signature, and a version number within a defined [VersionRange](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/browser/VersionRange.java). This class also provides some static instances for matching Chrome, Firefox and Samsung SBrowser. - [BrowserAllowList](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/browser/BrowserAllowList.java): takes a list of BrowserMatcher instances, and will match a browser if any of these child BrowserMatcher instances signals a match. - [BrowserDenyList](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/browser/BrowserDenyList.java): the inverse of BrowserAllowList - takes a list of browser matcher instances, and will match a browser if it _does not_ match any of these child BrowserMatcher instances. For instance, in order to restrict the authorization flow to using Chrome or SBrowser as a custom tab: ```java AppAuthConfiguration appAuthConfig = new AppAuthConfiguration.Builder() .setBrowserMatcher(new BrowserAllowList( VersionedBrowserMatcher.CHROME_CUSTOM_TAB, VersionedBrowserMatcher.SAMSUNG_CUSTOM_TAB)) .build(); AuthorizationService authService = new AuthorizationService(context, appAuthConfig); ``` Or, to prevent the use of a buggy version of the custom tabs in Samsung SBrowser: ```java AppAuthConfiguration appAuthConfig = new AppAuthConfiguration.Builder() .setBrowserMatcher(new BrowserDenyList( new VersionedBrowserMatcher( Browsers.SBrowser.PACKAGE_NAME, Browsers.SBrowser.SIGNATURE_SET, true, // when this browser is used via a custom tab VersionRange.atMost("5.3") ))) .build(); AuthorizationService authService = new AuthorizationService(context, appAuthConfig); ``` ### Customizing the connection builder for HTTP requests It can be desirable to customize how HTTP connections are made when performing token requests, for instance to use [certificate pinning](https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning) or to add additional trusted certificate authorities for an enterprise environment. This can be achieved in AppAuth by providing a custom [ConnectionBuilder](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/connectivity/ConnectionBuilder.java) instance. For example, to custom the SSL socket factory used, one could do the following: ```java AppAuthConfiguration appAuthConfig = new AppAuthConfiguration.Builder() .setConnectionBuilder(new ConnectionBuilder() { public HttpURLConnection openConnect(Uri uri) throws IOException { URL url = new URL(uri.toString()); HttpURLConnection connection = (HttpURLConnection) url.openConnection(); if (connection instanceof HttpsUrlConnection) { HttpsURLConnection connection = (HttpsURLConnection) connection; connection.setSSLSocketFactory(MySocketFactory.getInstance()); } } }) .build(); ``` ### Issues with [ID Token](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/IdToken.java#L118) validation ID Token validation was introduced in `0.8.0` but not all authorization servers or configurations support it correctly. - For testing environments [setSkipIssuerHttpsCheck](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/AppAuthConfiguration.java#L129) can be used to bypass the fact the issuer needs to be HTTPS. ```java AppAuthConfiguration appAuthConfig = new AppAuthConfiguration.Builder() .setSkipIssuerHttpsCheck(true) .build() ``` - For services that don't support nonce[s] resulting in **IdTokenException** `Nonce mismatch` just set nonce to `null` on the `AuthorizationRequest`. Please consider **raising an issue** with your Identity Provider and removing this once it is fixed. ```java AuthorizationRequest authRequest = authRequestBuilder .setNonce(null) .build(); ``` ## Dynamic client registration AppAuth supports the [OAuth2 dynamic client registration protocol](https://tools.ietf.org/html/rfc7591). In order to dynamically register a client, create a [RegistrationRequest](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/RegistrationRequest.java) and dispatch it using [performRegistrationRequest](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/AuthorizationService.java#L278) on your AuthorizationService instance. The registration endpoint can either be defined directly as part of your [AuthorizationServiceConfiguration](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/AuthorizationServiceConfiguration.java), or discovered from an OpenID Connect discovery document. ```java RegistrationRequest registrationRequest = new RegistrationRequest.Builder( serviceConfig, Arrays.asList(redirectUri)) .build(); ``` Requests are dispatched with the help of `AuthorizationService`. As this request is asynchronous the response is passed to a callback: ```java service.performRegistrationRequest( registrationRequest, new AuthorizationService.RegistrationResponseCallback() { @Override public void onRegistrationRequestCompleted( @Nullable RegistrationResponse resp, @Nullable AuthorizationException ex) { if (resp != null) { // registration succeeded, store the registration response AuthState state = new AuthState(resp); //proceed to authorization... } else { // registration failed, check ex for more details } } }); ``` ## Utilizing client secrets (DANGEROUS) We _strongly recommend_ you avoid using static client secrets in your native applications whenever possible. Client secrets derived via a dynamic client registration are safe to use, but static client secrets can be easily extracted from your apps and allow others to impersonate your app and steal user data. If client secrets must be used by the OAuth2 provider you are integrating with, we strongly recommend performing the code exchange step on your backend, where the client secret can be kept hidden. Having said this, in some cases using client secrets is unavoidable. In these cases, a [ClientAuthentication](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/ClientAuthentication.java) instance can be provided to AppAuth when performing a token request. This allows additional parameters (both HTTP headers and request body parameters) to be added to token requests. Two standard implementations of ClientAuthentication are provided: - [ClientSecretBasic](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/ClientSecretBasic.java): includes a client ID and client secret as an HTTP Basic Authorization header. - [ClientSecretPost](https://github.com/openid/AppAuth-Android/blob/master/library/java/net/openid/appauth/ClientSecretPost.java): includes a client ID and client secret as additional request parameters. So, in order to send a token request using HTTP basic authorization, one would write: ```java ClientAuthentication clientAuth = new ClientSecretBasic(MY_CLIENT_SECRET); TokenRequest req = ...; authService.performTokenRequest(req, clientAuth, callback); ``` This can also be done when using `performActionWithFreshTokens` on AuthState: ```java ClientAuthentication clientAuth = new ClientSecretPost(MY_CLIENT_SECRET); authState.performActionWithFreshTokens( authService, clientAuth, action); ``` ## Modifying or contributing to AppAuth This project requires the Android SDK for API level 25 (Nougat) to build, though the produced binaries only require API level 16 (Jellybean) to be used. We recommend that you fork and/or clone this repository to make modifications; downloading the source has been known to cause some developers problems. For contributors, see the additional instructions in [CONTRIBUTING.md](https://github.com/openid/AppAuth-Android/blob/master/CONTRIBUTING.md). ### Building from the Command line AppAuth for Android uses Gradle as its build system. In order to build the library and app binaries, run `./gradlew assemble`. The library AAR files are output to `library/build/outputs/aar`, while the demo app is output to `app/build/outputs/apk`. In order to run the tests and code analysis, run `./gradlew check`. ### Building from Android Studio In AndroidStudio, File -> New -> Import project. Select the root folder (the one with the `build.gradle` file).
