PendingIntents

A PendingIntent is a token that you give to another application or system component to perform a predefined action on your app’s behalf at some later time. It wraps an Intent and grants the recipient the authority to execute the action with your app’s permissions.

A PendingIntent is created using one of three factory methods: PendingIntent.getActivity, PendingIntent.getBroadcast, or PendingIntent.getService. Each method takes an Intent describing the action and optional flags. The resulting PendingIntent is handed to a recipient such as the system alarm manager, a notification action, or an app widget, which will trigger the underlying Intent when the event occurs.

Common use cases include scheduling actions with the AlarmManager, responding to user interaction in a notification, or updating an app widget. For example, a notification action can hold a PendingIntent that launches a specific Activity when the user taps it, or an AlarmManager can fire a PendingIntent to start a service at a set time.

Mutability flags are required starting in Android 12 (API level 31). When creating a PendingIntent you must specify either FLAG_IMMUTABLE or FLAG_MUTABLE. If you do not intend to modify the Intent data, use FLAG_IMMUTABLE; use FLAG_MUTABLE only if you need to alter extras at delivery. Other flags such as FLAG_UPDATE_CURRENT or FLAG_CANCEL_CURRENT control how existing PendingIntents are treated.

Security considerations include exposing PendingIntents to untrusted apps, so use explicit intents, prefer immutable PendingIntents when possible, and validate the receiving component. Proper use helps prevent tampering and leakage of sensitive data.