A software development kit (SDK) is a bundle of ready-made code libraries, tools, sample code and documentation that helps developers build software for a particular platform or service. A payment company ships an SDK so that merchants can add checkout to their apps; a phone maker ships one so that developers can write apps for its devices; a blockchain project ships one so that wallets and services can read the chain and send transactions.
An SDK usually wraps an application programming interface (API). The API is the set of requests a service accepts; the SDK is the toolkit that makes calling it easier in a given programming language, handling details such as authentication, retries, error messages and data formats. In fintech, SDKs are the main way providers such as payment gateways, identity checkers and crypto platforms get their products embedded in other companies' apps.
Software development kit in plain terms
Buying flat-pack furniture is easier when the box contains not only the parts but also the right screws, an Allen key and a picture guide. You could source the screws yourself, but the kit saves time and reduces the chance of building something wobbly.
An SDK is that box for programmers. A bank or payment company has a service it wants others to use; rather than asking each developer to work out every detail, it hands over pre-built pieces and instructions so the job is done faster and in the way the provider intended.
What an SDK contains
- Libraries. Code that developers include in their own projects, written for specific languages or platforms such as iOS, Android, JavaScript, Java or Python.
- User interface components. Pre-built screens such as a card entry form, a bank-login window or a QR scanner, so the app does not need to design sensitive flows itself.
- Tools. Compilers, debuggers, test environments ("sandboxes") and command-line utilities.
- Documentation and samples. Reference guides, tutorials and example apps that show the intended way to use the service.
Platform SDKs, such as the one Apple released for iPhone apps in March 2008, are large and cover a whole operating system. Service SDKs are smaller and focus on one product. Many are published as open-source code so that developers can inspect exactly what runs inside their apps.
SDKs in payments and banking
Payment providers rely on SDKs to make integration fast and to keep sensitive data away from merchants. A typical mobile checkout SDK from a payment processor collects card details in its own secure component and sends them straight to the provider, so the merchant's servers only see a token. This reduces the merchant's compliance burden and its exposure to data security incidents.
Other common examples include:
- Open banking SDKs that show a bank-login window and return account data or start a payment with the customer's consent.
- Identity verification SDKs that capture a passport photo and a selfie for onboarding checks.
- Wallet and tokenisation SDKs that add cards to phone wallets or enable QR code payments.
- Embedded finance and banking-as-a-platform SDKs that let non-banks offer accounts, cards or loans inside their own apps, sometimes as a white-label product.
Money transfer companies often combine several of these; the trade-offs between building and buying are discussed under software for money transfer business and remittance software developer. Some providers go further and offer a single super API with one SDK that reaches many underlying services.
SDKs in blockchain and crypto
On Ethereum and similar networks, SDKs connect apps to blockchain nodes and handle the cryptography needed to sign transactions. JavaScript libraries such as ethers.js, web3.js and viem let a website read balances, estimate the gas limit of a call, format amounts in gwei and send transactions from an externally owned account (EOA). Developers who write contracts in Solidity use the same libraries to call them from front-end code.
Wallet providers publish SDKs so that decentralized applications (DApps) can connect to a user's Web3 wallet, or so that apps can create embedded wallets for users without a separate download, often backed by multi-party computation (MPC) key management. Custody firms, exchanges and crypto on-ramp services offer SDKs that let fintech apps buy, hold or send crypto and stablecoin payments through a regulated partner.
Risks and good practice
An SDK runs inside the app that uses it, with the same access to data and permissions. That brings risks:
- Supply-chain attacks. A compromised library update can steal keys or card data from every app that installs it. Crypto libraries have been targeted this way, for example Ledger's Connect Kit in December 2023 and the @solana/web3.js package in December 2024.
- Privacy and data sharing. Analytics and advertising SDKs can collect more user data than the app owner realises, which raises data protection questions.
- Lock-in. Deep use of one provider's SDK makes switching providers costly.
Common safeguards include pinning SDK versions, reviewing release notes before updating, checking signatures or hashes of downloaded packages and following security hardening guidance for mobile and web apps. Regulated firms usually treat a critical SDK provider as an outsourcing relationship, with due diligence and contracts to match.