React Native SDK - Changelog

All notable changes to the Glomo React Native SDK.

The format is based on Keep a Changelog, and the SDK adheres to Semantic Versioning.

The canonical changelog ships with the npm package. This page mirrors it for convenience.

A feature release. No API changed and no existing code needs to move - appColorScheme is optional and defaulted. If your app or your network restricts outbound hosts, see the Migration Guide; nothing else needs anything.

• appColorScheme prop ("auto" | "light" | "dark", default "auto") on GlomoCheckout, providing the Glomo checkout page the preferred colour scheme. It requests rather than forces: the page decides, against your merchant dashboard settings. Changing it during a live checkout is supported and does not reload the page, so a payment in flight survives it. Optional and defaulted, so existing integrations need no change. See Dark mode, and Dark mode across the SDKs for how the same property resolves on the other Glomo SDKs.
• GlomoColorScheme type, exported.

• Improved SDK diagnostics and observability revamp to better assist merchants.
  • If you restrict outbound hosts, see the Migration Guide.
• Android WebView algorithmic darkening is now explicitly off on every WebView the SDK renders, including bank and 3DS pages. Previously the platform could invert a page that handles its own colours. Nothing to configure.

• "auto" resolves to your app's effective appearance (Appearance.getColorScheme()), not the device setting underneath it - React Native does not expose the latter once an app overrides its own appearance. See Dark mode, which also covers why the prop is appColorScheme while the URL parameter stays colorScheme.
• Pin jail-monkey to the 2.x line. jail-monkey@latest is 3.0.0, and on an app that has not enabled the New Architecture its native module does not compile at all: it passes a ReactApplicationContext to a no-argument constructor and reads an undeclared rootedCheck, so the build stops at :jail-monkey:compileReleaseJavaWithJavac before any Glomo code is reached. No 3.x patch exists. The SDK's peer range has always been ^2.6.0 and is unchanged; what changed is that the install commands now pin it rather than resolving latest. Nothing in the SDK moved - this is recorded here because a fresh npm install jail-monkey is the likeliest way to walk into it.
• Android hosts should declare uiMode in their activity's android:configChanges. Without it, an OS dark-mode toggle destroys and recreates your activity mid-checkout and loses the payment in flight. This is pre-existing behaviour and not new in this release, but it matters more now that users have a reason to toggle. The SDK ships no native Android code and cannot detect or prevent it. See Required on Android: uiMode.

Part of the v5 documentation.

• jail-monkey is now a required peer dependency, and device compliance fails closed. It was optional in v4 and the SDK warned and proceeded when it was missing. A device whose security cannot be verified is now refused on a live_ key rather than assumed clean: start() returns false and onSdkError fires with type: "device_forbidden". Mock and test keys are never blocked, so this does not show up in a test_ key QA pass. See the Migration Guide first - this can take a working live integration off the air.
• onUserRefusedCameraPermissions renamed to onUserRefusedDevicePermissions. The signature is unchanged, so the compiler points at every call site. The new name reflects what the callback covers - a device permission the bank's page asked for - rather than the camera specifically.
• paymentId and signature are optional on GlomoCheckoutPayload. The checkout page can report a terminal outcome before the backend has resolved those ids; v4 dropped such outcomes entirely rather than report an incomplete one. With strict enabled this surfaces as a compile error wherever either value is forwarded to something expecting a string, which is the intended guardrail.
• onPaymentTerminate receives a GlomoTerminationPayload. Carries source, from the new TERMINATION_SOURCES enum. An existing () => void handler stays assignable and compiles unchanged.

• Document downloads. A checkout page can now ask the SDK to save a document to the device, which a page cannot do for itself inside a WebView. Available on every flow. Requires two optional peer dependencies - react-native-blob-util and @react-native-documents/picker - and a rebuild of the app after installing them; without both the SDK does not advertise the capability and the page keeps its existing behaviour, so nothing breaks by leaving them out. A save that fails reports through onSdkError with field: "file.save" and never affects the payment session. See Document Downloads.
• TERMINATION_SOURCES enum and GlomoTerminationPayload type, both exported.
• Emulators and simulators now pass device compliance on live keys. The SDK computes its own root verdict from jail-monkey's per-check breakdown instead of its aggregate, which reports every stock Android emulator image as rooted. Every strong root indicator is still enforced.
• product and surface query parameters on the checkout and education carousel URLs, so an SDK-originated order is distinguishable from a dashboard one.

• A mock_ public key ran in live mode. It passed validation and then had mode=live built into its checkout URL.
• Camera now works on LRS checkouts. The LRS flow had no permission handling wired on either platform, so a bank page requesting camera access got no prompt on Android and no grant on iOS. It now behaves identically to the standard checkout.
• onUserRefusedDevicePermissions is now forwarded to LRS. The unified GlomoCheckout accepted the callback and advertised it in its types, but never passed it to the LRS flow - so on an LRS order it could never fire. Note it remains Android-only: on iOS the WebView raises its own prompt and never reports the answer back.
• Terminal payment outcomes are no longer dropped silently. A payload the SDK could not route left no trace in a release build - no callback, no telemetry, nothing for support to find. It now reports through onSdkError and telemetry.
• The SDK's back chevron has a touch target that meets the 44dp / 44pt minimum, an accessibility label and a button role.

• WebView configuration, permission handling and bridge message routing moved into a shared layer used by every checkout flow, so capabilities land on all flows at once rather than being wired per flow.
• Improved SDK diagnostics.

Part of the v5 documentation. See the Migration Guide for upgrade instructions.

• End-to-end test harness and CI for Android and iOS. No change to SDK behaviour or public API.

Part of the v4 documentation (Archived).

• Consolidated async payment callbacks: onBankTransferSubmitted and onPayViaBankCompleted have been replaced by a single onUserJourneyCompleted callback. The new callback receives a GlomoUserJourneyCompletedPayload with a journeyType field from the ASYNC_PAYMENT_EVENTS enum.
• Removed onPayViaBankBankConnectionSuccessful: This callback has been removed.
• Removed types: GlomoBankTransferPayload and GlomoPayViaBankConnectionPayload are no longer exported.
• onSdkError is now required: Previously optional, onSdkError must now be provided. This ensures validation errors, device compliance failures, and configuration issues are handled properly.

• ASYNC_PAYMENT_EVENTS enum: Enumeration of asynchronous payment event types (BANK_TRANSFER_SUBMITTED, PAY_VIA_BANK_COMPLETED).
• GlomoUserJourneyCompletedPayload type: Flat payload interface with journeyType, orderId?, status?, senderAccountNumber?, transactionReference?.
• onUserJourneyCompleted callback: Single callback for all asynchronous payment flow completions.

• CheckoutStatus values bank_transfer_submitted and pay_via_bank_completed remain for granular getStatus() state checks.

Part of the v4 documentation (Archived). See the Migration Guide for upgrade instructions.

• Subscriptions checkout support - new subscriptionId prop on GlomoCheckout. When provided, the SDK bypasses order type detection and renders the subscriptions checkout flow directly. No API call is made - the inner checkout component mounts immediately. The detecting_order_type status is not emitted for subscription flows.
• Mutual exclusion validation - GlomoCheckout validates that exactly one of orderId or subscriptionId is provided. If both or neither are set, onSdkError fires with a clear message and start() returns false.

• orderId is now optional on GlomoCheckoutProps - required only when subscriptionId is absent.

• useGlomoCheckout hook - use the GlomoCheckout component with a ref instead. The hook does not provide reactive state - getStatus() returns a point-in-time snapshot. Will be removed in a future major version.

Part of the v3 documentation.

• onPayViaBankBankConnectionSuccessful callback - fires when a bank connection is successfully established during the pay via bank flow. Provides GlomoPayViaBankConnectionPayload (bankIdentifier, cooldownPeriodInMinutes, bankName, bankImageSrc, bankImageAlt). This is informational only and does not change the checkout status.
• GlomoPayViaBankConnectionPayload type - new exported type for the bank connection callback payload.

• Repeat start() calls with the same orderId no longer fail silently due to cached API responses.
• Checkout dismissal now fully resets internal state, preventing stale UI on re-open.

Part of the v3 documentation.

• New unified component: GlomoLrsCheckout has been replaced by GlomoCheckout. The new component automatically detects the order type (LRS or Standard) and renders the appropriate checkout flow.
• start() is now async: Returns Promise<boolean> instead of boolean. Update call sites to await:
  const started = await checkoutRef.current?.start();

• Renamed exports:

  v2	v3
  GlomoLrsCheckout	GlomoCheckout
  GlomoLrsCheckoutRef	GlomoCheckoutRef
  GlomoLrsCheckoutProps	GlomoCheckoutProps
  GlomoLrsCheckoutPayload	GlomoCheckoutPayload
  GlomoLrsServer	GlomoServer
  LrsCheckoutStatus	CheckoutStatus
  useLrsCheckout	useGlomoCheckout

• Removed exports: v2 LRS-specific names are no longer available.

• Standard checkout support - cards, bank transfers, pay via bank, and camera-based bank authentication flows, all through the same GlomoCheckout component. No integration changes needed - the order type is detected automatically.
• onBankTransferSubmitted callback - fires when the user submits bank transfer details in a standard checkout flow. Provides GlomoBankTransferPayload (orderId, senderAccountNumber, transactionReference).
• onPayViaBankCompleted callback - fires when the pay via bank journey completes. Provides { status: string }.
• onUserRefusedCameraPermissions callback - fires when the user denies camera access during bank authentication (Android only). The checkout is dismissed automatically.
• detecting_order_type checkout status - returned by getStatus() while the SDK determines the order type.
• bank_transfer_submitted checkout status - indicates a bank transfer has been submitted and is awaiting confirmation.
• pay_via_bank_completed checkout status - indicates the pay via bank flow has completed.
• GlomoBankTransferPayload type - new exported type for the bank transfer callback payload.
• useGlomoCheckout hook - for advanced integration patterns needing direct access to order type detection state.

Checkout flows with camera-based bank authentication require native permissions:

• Android (AndroidManifest.xml): <uses-permission android:name="android.permission.CAMERA" />
• iOS (Info.plist): NSCameraUsageDescription key

These are only required for flows that use camera-based bank authentication.

See the Migration Guide for upgrade instructions from v1.

Private v2 release candidate with experimental features. Not available for general use.

Backwards compatible with v1.x

Last v1 release. See v1 documentation.

LRS-only checkout via GlomoLrsCheckout component. Synchronous start() method. Device security compliance via optional jail-monkey integration.

• React Native SDK documentation - latest version (v5)
• Migration Guide (v1 to v5)
• React Native SDK v4 (Archived)
• React Native SDK v3 (Archived)
• React Native SDK v1 (Archived)