---
title: Android manifest setup
description: Which permissions the Extentos Android SDK auto-merges for you and which capability permissions (CAMERA, RECORD_AUDIO, INTERNET) your app must declare, plus the bundled foreground service.
type: reference
platform: android
vendor: meta
related:
  - /docs/concepts/permissions
  - /docs/sdk/android/install
  - /docs/sdk/android/lifecycle
  - /docs/sdk/android/initialization
---

<Callout type="warn">
  **Camera and display need the Meta vendor module.** `com.extentos:glasses`
  carries no vendor SDK, so add `implementation("com.extentos:glasses-meta")`
  alongside it — see [install](/docs/sdk/android/install). Without it the build
  still succeeds and voice still works, but `capabilities.camera` is `false` and
  captures return errors. The SDK logs a warning at startup when it spots that
  combination.
</Callout>


The Extentos Android SDK ships an `AndroidManifest.xml` that the Android manifest merger folds into your app at build time. Some entries are zero-config (the library declares them for you); the **capability** permissions stay app-owned because they gate features only your app knows it needs.

## What the library declares for you

These are merged in automatically — you do **not** add them:

| Entry | Kind | Purpose |
|---|---|---|
| `BLUETOOTH_CONNECT` | permission | The universal connection permission — every glasses app needs it to discover and talk to the glasses. The SDK requests it at runtime once the Meta transport is running — **but a camera app must have it granted before `ExtentosGlasses.create(...)`**, because the transport choice depends on it and is made inside that call. See [permissions](/docs/concepts/permissions#always-required). |
| `BLUETOOTH_SCAN` | permission | Discovering nearby glasses. |
| `MODIFY_AUDIO_SETTINGS` | permission | Routing the glasses mic + speaker over Bluetooth SCO/HFP. Without it, SCO never starts and an awake assistant hears nothing. Normal-protection, so it auto-grants. |
| `GlassesForegroundService` | `<service>` | Bundled foreground service for background-surviving mic capture (see below). |
| `DAM_ENABLED` meta-data | `<meta-data>` | Meta's Device Access Model flag, required by the **display** capability. Defaults to **`false`**: on DAT 0.8, DAM makes the SDK demand an on-glasses companion app that current non-display glasses don't yet have, which drops the session — so camera/audio apps run the non-DAM path and stay connected. If your declared footprint includes Display, `generateConnectionModule` re-enables it for you (`DAM_ENABLED=true` via `tools:replace`). |
| `networkSecurityConfig` | `<application>` attr | A narrow cleartext exception for localhost-equivalent hosts only (`10.0.2.2`, `127.0.0.1`, `localhost`) so the dev-loop auto-bind probe can reach your local MCP server. A no-op in real-world traffic. |

> **Conflict on `networkSecurityConfig`?** If your app already declares its own `android:networkSecurityConfig`, the merger reports a conflict. Resolve it by adding `tools:replace="android:networkSecurityConfig"` to your app manifest's `<application>` tag (and add `xmlns:tools="http://schemas.android.com/tools"` to the `<manifest>` root if it isn't there).

## What you add

The library leaves **capability** permissions to you, so your manifest declares only what your app actually uses. Add the ones matching the capabilities you call:

```xml title="app/src/main/AndroidManifest.xml"
<!-- Photo / video capture -->
<uses-permission android:name="android.permission.CAMERA" />

<!-- Voice, transcription, audio chunks, the assistant -->
<uses-permission android:name="android.permission.RECORD_AUDIO" />

<!-- Reaching the managed gateway / simulator / telemetry -->
<uses-permission android:name="android.permission.INTERNET" />

<!-- Background mic capture via the bundled foreground service (Android 14+) -->
<uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
<uses-permission android:name="android.permission.FOREGROUND_SERVICE_MICROPHONE" />
```

| Permission | Add it when you use… | Runtime grant? |
|---|---|---|
| `CAMERA` | `glasses.camera.capturePhoto()`, `captureVideo()`, `videoFrames()` | Yes — request at runtime |
| `RECORD_AUDIO` | `glasses.audio.*`, `glasses.voice.*`, `glasses.assistant.*` | Yes — request at runtime |
| `INTERNET` | Always (gateway, simulator, telemetry) | No — normal permission |
| `FOREGROUND_SERVICE` + `FOREGROUND_SERVICE_MICROPHONE` | You start the bundled `GlassesForegroundService` (background mic for voice / transcription / the assistant). `_MICROPHONE` is required on Android 14+. | No — normal permissions |

### Camera or display apps also add the Meta credential entries

Permissions aren't the whole manifest. An app using the vendor transport must also carry the two Meta DAT `<meta-data>` elements inside `<application>`, or MWDAT can't initialize:

```xml title="app/src/main/AndroidManifest.xml"
<application …>
    <meta-data android:name="com.meta.wearable.mwdat.APPLICATION_ID"
               android:value="@string/meta_application_id" />
    <meta-data android:name="com.meta.wearable.mwdat.CLIENT_TOKEN"
               android:value="@string/meta_client_token" />
</application>
```

The string resources come from `app/src/main/res/values/extentos_meta_credentials.xml`, which `generateConnectionModule` writes from the credentials you stored in your dashboard project — there is no runtime injection path through `ExtentosConfig`. See [credentials](/docs/mcp-server/credentials-checklist). **Voice-only apps skip this** — they have no DAT dependency.

For the runtime-request flow and which capability needs which permission, see the [`getPermissions` MCP tool](/docs/reference/mcp-tools) and [Permissions](/docs/concepts/permissions).

## The bundled foreground service

For background-surviving microphone capture (a voice assistant or live transcription that must keep listening while your app is backgrounded), the library declares a foreground service for you:

```xml
<service
    android:name="com.extentos.glasses.core.service.GlassesForegroundService"
    android:foregroundServiceType="microphone"
    android:exported="false" />
```

You don't declare it — you **start** it from an Activity, **after** `RECORD_AUDIO` has been granted at runtime:

```kotlin
import com.extentos.glasses.core.service.GlassesForegroundService

// In your permission-grant callback, once RECORD_AUDIO is PERMISSION_GRANTED:
GlassesForegroundService.start(this)   // 'this' is any Context

// Later, when you no longer need background capture:
GlassesForegroundService.stop(this)
```

`start` is idempotent. Do **not** call it from `Application.onCreate` — Android 14+ requires the `RECORD_AUDIO` grant to be in place before `startForeground(...)` runs, or the app crashes at service-create time. See [Lifecycle](/docs/sdk/android/lifecycle) for the full wiring.

> Camera-only or strictly foreground apps don't need the service at all — the declaration is harmless if unused. A camera-type foreground service (rare; for surviving `videoFrames` in the background) requires you to subclass `GlassesForegroundService` and declare your own `<service android:foregroundServiceType="camera" />`.

> Building on iOS too? Permissions there are Info.plist keys, not manifest entries — see the [iOS SDK](/docs/sdk/ios) pages.