Checkout SDK Updates — Web v1.3.1, Android v1.2.0, iOS v1.5.0

Web SDK — v1.3.1 (2026-07-23)

Stripe Radar: stripeRadar(publishableKey, options?) (Hosted Fields and Express Checkout) wraps Stripe.createRadarSession() and resolves with the Radar session id (or null on failure) to forward with a Stripe Payment Intents charge; legacy Spreedly.stripeRadar(...) parity (callback → Promise).

Breaking (offsite): the offsitePaymentError payload shape changed from { message, error } (1.2.0) to { message, status, errors }.

Hosted Fields cardholder name typing: HostedFieldsFormData.first_name and last_name are now correctly optional — provide either full_name or both first_name + last_name; the SDK forwards what is supplied and Spreedly Core enforces the requirement. (Express Checkout's prebuilt form is unchanged.)
Hosted Fields integration guide now documents sdk.validate() and the structured field-level validation event.

Additive parameters CheckoutButton.isFormValid, AppTextField.maxLength, and a NameValidator min length; prior signatures are retained via hidden compatibility overloads / @JvmOverloads.

PaymentProcessingResult (payments-core) adds Rejected(ALREADY_PROCESSING) and Failed(UNEXPECTED_ERROR). processPayment() returns this sealed type, so exhaustive when expressions must handle the new branches (or add an else). Card flows never return the new values, but the type is shared.

Express checkout guide clarifies that card sheet borderRadius and fieldShape are independent

Stripe Radar device data: optional SpreedlyStripeRadar module collects a Radar session ID via createRadarSession (Swift) or createRadarSessionWithConfig:completion: (ObjC); pass radar_session_id under gateway_specific_fields.stripe_payment_intents on the next purchase. Headless — uses StripePayments only, not Payment Sheet.
SPLTextField.requiredMessage: optional Swift parameter and ObjC property to override the default required-field validation message.
FormFieldType.bankName: optional bank name on SPLTextField, BankAccountFormDropIn, and headless createBankAccount when enabled via BankAccountFieldConfig.

Braintree unparseable created_at: checkout now blocks launch when created_at cannot be parsed (same outcome as an expired token); missing or blank created_at still allows launch.
Headless name fields on tokenize: createCreditCard resolves holder names from AdditionalField when secure-container values are absent (Android parity).

Built-in screen prevention on drop-ins: CardFormDropIn, BankAccountFormDropIn, and SpreedlyCVVRecachingView apply screenshot/recording protection automatically — no merchant wrap required on those components. Custom forms still need merchant .screenPrevention().