Application Environment Verification: Mobile API Security

Overview

Application Environment Verification (AEV) technology focuses on securing the communication channel between mobile applications and their backend APIs. It operates by validating the integrity of the client application and its runtime environment before allowing API requests to proceed. This process aims to differentiate legitimate user interactions from automated attacks, manipulated clients, or compromised environments.

Approov, founded in 2017, provides AEV solutions designed primarily for mobile API security. Its core products, Approov Mobile App Protection and Approov API Threat Protection, are engineered to defend backend APIs against a range of threats including bots, credential stuffing, scraping, and other forms of API abuse. The technology integrates directly into mobile applications via SDKs, which are available for various platforms such as iOS, Android, React Native, and Flutter. This client-side integration allows for the attestation of the app's authenticity and the integrity of its operating environment.

The system works by issuing short-lived, cryptographically signed tokens from the Approov cloud service to verified mobile applications. These tokens are then included with API requests to the backend, where a server-side component validates them. This ensures that only requests from genuine, untampered apps running in secure environments can access the API. The approach helps prevent common mobile-specific threats such as API key compromise, reverse engineering of apps, and the use of emulators or rooted/jailbroken devices to bypass security controls.

AEV is particularly beneficial for organizations that rely heavily on mobile applications for critical business functions, such as financial services, healthcare, and e-commerce, where protecting sensitive user data and preventing fraud are paramount. It is also suitable for any API provider looking to mitigate the risks associated with public-facing APIs that are consumed by mobile clients. The solution aims to reduce the load on backend systems from malicious traffic and enhance the overall security posture of mobile-centric architectures.

Developers implementing Approov will find SDKs for a variety of mobile development frameworks, which simplifies the integration process into existing applications. The documentation provides server-side examples for integrating the token validation into various backend technologies, enabling a comprehensive end-to-end security implementation. This developer experience note highlights the solution's focus on providing actionable tools for both client-side and server-side integration.

Key features

• Mobile App Attestation: Verifies the authenticity and integrity of the mobile application at runtime, ensuring it has not been tampered with or modified.
• Environment Verification: Checks the mobile device's environment for indicators of compromise, such as rooting, jailbreaking, emulation, or debugging tools.
• API Threat Protection: Defends backend APIs from automated attacks, including bots, credential stuffing, scraping, and denial of service, by blocking requests from unverified sources.
• Runtime Application Self-Protection (RASP): Provides protection against dynamic threats by monitoring and reacting to runtime behaviors that indicate compromise or malicious activity.
• Short-Lived Cryptographic Tokens: Generates and validates tokens that expire quickly, limiting the window for replay attacks or token theft.
• SDK Integration: Offers SDKs for popular mobile development platforms (iOS, Android, React Native, Flutter, Xamarin, Titanium, NativeScript, Cordova, MAUI) to facilitate client-side integration.
• Backend Integration Guides: Provides documentation and examples for integrating token validation into various backend server technologies.
• Managed Service: Operates as a cloud-based service, offloading the complexity of threat intelligence and attestation logic from the application developer.

Pricing

Approov offers a tiered pricing model, including a free trial and various paid plans tailored to different usage volumes. Custom enterprise pricing is also available for larger deployments.

Pricing as of 2026-05-28. For the most current pricing details, refer to the Approov pricing page.

Common integrations

• Backend Servers: Integrates with various backend technologies to validate Approov tokens, including Node.js, Java, Python, Ruby, and PHP. The Approov API reference provides details.
• Mobile SDKs: Direct integration into mobile applications developed with iOS (iOS SDK integration guide), Android (Android SDK integration guide), React Native, Flutter, Xamarin, and other frameworks.
• API Gateways: Can be deployed with API gateways to enforce AEV policies at the edge of the network. For example, some solutions offer integrations with Kong Gateway or other similar platforms.
• Cloud Platforms: Backend components can be deployed on major cloud providers such as AWS, Google Cloud, and Azure.

Alternatives

• DataDome: Offers AI-powered bot and online fraud protection, specializing in real-time detection and blocking of malicious traffic.
• Cloudflare Bot Management: Provides bot detection and mitigation services as part of Cloudflare's broader web security platform, leveraging its global network.
• Akamai: A comprehensive content delivery network and cloud security provider, offering various solutions for web application and API protection, including bot management.

Getting started

To begin using Approov, developers typically integrate the Approov SDK into their mobile application and implement server-side token validation. The following Swift example demonstrates a basic setup for an iOS application, showing how to fetch an Approov token before making an API call.

import Foundation
import ApproovSDK

class APIClient {
    let session: URLSession
    let baseURL: URL

    init(baseURL: URL) {
        self.baseURL = baseURL
        // Initialize URLSession with Approov interceptor if available
        self.session = URLSession.shared
        Approov.initialize(config: "YOUR_APPROOV_CONFIG_STRING")
    }

    func makeSecuredRequest(path: String, completion: @escaping (Result<Data, Error>) -> Void) {
        var request = URLRequest(url: baseURL.appendingPathComponent(path))
        request.httpMethod = "GET"

        // Fetch Approov token asynchronously
        Approov.fetchApproovToken { approovResult in
            switch approovResult {
            case .success(let token): // Token successfully obtained
                if let tokenString = token {
                    request.addValue(tokenString, forHTTPHeaderField: "Approov-Token")
                    print("Approov token added: \(tokenString)")
                    self.executeRequest(request: request, completion: completion)
                } else {
                    completion(.failure(APIError.approovTokenMissing))
                }
            case .failure(let error): // Failed to obtain token
                print("Approov token fetch failed: \(error.localizedDescription)")
                completion(.failure(error))
            }
        }
    }

    private func executeRequest(request: URLRequest, completion: @escaping (Result<Data, Error>) -> Void) {
        session.dataTask(with: request) { data, response, error in
            if let error = error {
                completion(.failure(error))
                return
            }

            guard let httpResponse = response as? HTTPURLResponse, (200...299).contains(httpResponse.statusCode) else {
                let statusCode = (response as? HTTPURLResponse)?.statusCode ?? -1
                completion(.failure(APIError.invalidResponse(statusCode: statusCode)))
                return
            }

            guard let data = data else {
                completion(.failure(APIError.noData))
                return
            }
            completion(.success(data))
        }.resume()
    }
}

enum APIError: Error, LocalizedError {
    case approovTokenMissing
    case invalidResponse(statusCode: Int)
    case noData

    var errorDescription: String? {
        switch self {
        case .approovTokenMissing: return "Approov token was not provided."
        case .invalidResponse(let statusCode): return "Invalid response from server with status code: \(statusCode)"
        case .noData: return "No data received from server."
        }
    }
}

// Example Usage (assuming you have your Approov config string and API base URL)
// let client = APIClient(baseURL: URL(string: "https://api.yourapp.com")!)
// client.makeSecuredRequest(path: "/data") { result in
//     switch result {
//     case .success(let data):
//         print("Received data: \(String(data: data, encoding: .utf8) ?? "")")
//     case .failure(let error):
//         print("API request failed: \(error.localizedDescription)")
//     }
// }

This Swift code snippet illustrates the client-side integration. After initializing the Approov SDK with a configuration string, the makeSecuredRequest function attempts to fetch an Approov token. If successful, this token is added to the Approov-Token HTTP header before the API request is made. On the backend, a corresponding Approov SDK or integration point would then validate this token to ensure the request's legitimacy before processing it. Complete integration details, including server-side examples and full configuration instructions, are available in the Approov documentation.