Application Environment Verification SDKs & Libraries: Integration (2026)

SDKs overview

Application Environment Verification offers a suite of Software Development Kits (SDKs) designed to facilitate the integration of its mobile app protection capabilities into diverse application environments. These SDKs are engineered to enable client-side application integrity verification, a critical component for protecting backend APIs from various threats, including bots, credential stuffing, and unauthorized access attempts. By embedding verification logic directly within the application, the SDKs ensure that API requests originate from legitimate, untampered application instances.

The developer experience with Application Environment Verification is streamlined through these SDKs, which abstract much of the complexity involved in implementing robust security measures. The official Approov documentation provides detailed guides for each supported platform, along with server-side integration examples for common backend technologies. This comprehensive approach aims to simplify the deployment of API protection across the entire application stack, from mobile client to backend API endpoints.

Integrating these SDKs allows developers to implement Runtime Application Self-Protection (RASP) principles, where the application actively defends itself against attacks. This capability is particularly relevant in environments where mobile applications interact with sensitive APIs, requiring assurance that the requesting application has not been compromised or tampered with.

Official SDKs by language

Application Environment Verification provides official SDKs for a broad range of mobile development platforms and languages, ensuring compatibility with most modern application development workflows. These SDKs are maintained directly by the vendor and are the recommended method for integrating Application Environment Verification's services.

Each SDK is designed to be idiomatic to its respective platform, leveraging native language features and package management systems to provide a familiar integration experience. This approach minimizes the learning curve for developers already proficient in a given mobile ecosystem. For detailed setup instructions, developers should refer to the Application Environment Verification API reference specific to their chosen platform.

Installation

Installation procedures vary depending on the target platform and development environment. The following outlines general steps and common commands, but specific versions and dependencies should always be verified against the official documentation.

iOS (Swift/Objective-C)

For iOS projects, CocoaPods is a common dependency manager. To integrate, add the following to your Podfile:

platform :ios, '11.0'
use_frameworks!

target 'YourAppTarget' do
  pod 'Approov'
end

Then, run pod install in your project directory. Alternatively, Swift Package Manager (SPM) can be used by adding the Approov SDK repository URL to your Xcode project.

Android (Kotlin/Java)

For Android projects, integration is typically managed via Gradle. Add the following to your app-level build.gradle file:

dependencies {
    implementation 'io.approov:approov-sdk:latest.release'
}

Ensure your project's build.gradle includes the Maven Central repository:

allprojects {
    repositories {
        google()
        mavenCentral()
    }
}

React Native

Install the React Native Approov SDK using npm or yarn:

npm install @approov/react-native-approov-sdk
# or
yarn add @approov/react-native-approov-sdk

cd ios && pod install && cd .. # for iOS projects

Additional platform-specific setup (e.g., linking native modules) may be required as detailed in the React Native SDK documentation.

Flutter

Add the approov_sdk dependency to your pubspec.yaml file:

dependencies:
  flutter:
    sdk: flutter
  approov_sdk: ^latest_version # Check pub.dev for the latest version

Then run flutter pub get. Platform-specific configurations for iOS and Android are necessary after this step.

Xamarin / MAUI

For Xamarin and MAUI applications, the Approov SDK is available as a NuGet package. Install it through the NuGet Package Manager in Visual Studio:

Install-Package Approov-SDK # For Xamarin
Install-Package Approov.Maui # For MAUI

Further platform-specific initialization code is required within your application's entry point.

Quickstart example

The following example demonstrates a basic integration of the Application Environment Verification SDK for an Android application using Kotlin. This snippet illustrates how to initialize the SDK and add an Approov token to an outgoing HTTP request using an OkHttp interceptor. Similar patterns apply to other platforms, adapting to their native networking stacks and language conventions. For a complete integration, refer to the official Application Environment Verification quickstart guides.

Android (Kotlin) with OkHttp

import android.app.Application
import io.approov.service.approovservice.ApproovService
import okhttp3.Interceptor
import okhttp3.OkHttpClient
import okhttp3.Response
import java.io.IOException

class MyApplication : Application() {

    override fun onCreate() {
        super.onCreate()
        // Initialize Approov SDK with your configuration string
        // The configuration string is obtained from the Approov CLI or console.
        ApproovService.initialize(this, "YOUR_APPROOV_CONFIG_STRING")

        // Set up Approov with pins for your API domain
        // Replace 'api.example.com' with your actual API domain.
        ApproovService.getNetworkingStack().setApproovPins(setOf("api.example.com"))

        // Optionally, if using dynamic pinning, set the SHA-256 hash of the API key
        // ApproovService.getNetworkingStack().setApproovKey("YOUR_API_KEY_SHA256_HASH")
    }
}

// OkHttp Interceptor to add Approov tokens to requests
class ApproovInterceptor : Interceptor {
    @Throws(IOException::class)
    override fun intercept(chain: Interceptor.Chain): Response {
        val requestBuilder = chain.request().newBuilder()

        // Get an Approov token. This call blocks until a token is retrieved or an error occurs.
        // It handles network requests to the Approov cloud service internally.
        val approovToken = ApproovService.getNetworkingStack().getApproovToken("api.example.com")

        // Add the Approov token to the request header.
        // The header name 'Approov-Token' is a common default.
        if (approovToken.isNotEmpty()) {
            requestBuilder.header("Approov-Token", approovToken)
        }

        // If using secure strings, retrieve them and add to headers if needed.
        // val secureString = ApproovService.getNetworkingStack().getSecureString("YOUR_SECURE_STRING_KEY")
        // if (secureString.isNotEmpty()) {
        //     requestBuilder.header("X-Secure-Data", secureString)
        // }

        return chain.proceed(requestBuilder.build())
    }
}

// Example of how to integrate the interceptor with OkHttpClient
fun createOkHttpClient(): OkHttpClient {
    return OkHttpClient.Builder()
        .addInterceptor(ApproovInterceptor())
        .build()
}

This quickstart demonstrates the core principle: initializing the SDK once and then integrating a mechanism (like an HTTP interceptor) to inject the Approov token into every relevant API request. On the server side, your API gateway or backend service would then validate this token to ensure the request originated from a legitimate application instance.

Community libraries

While Application Environment Verification primarily emphasizes its official SDKs for core integration, the open-source community often develops helper libraries or integrations that complement official offerings. These community-driven projects can provide:

• Framework-specific integrations: Adaptations or wrappers for less common frameworks or specific architectural patterns not directly covered by official SDKs.
• Utility functions: Helpers for common tasks that simplify SDK usage in particular contexts.
• Language bindings: Support for languages where an official SDK might not exist or is less mature.

Developers seeking community contributions should explore platforms like GitHub, GitLab, and relevant package repositories (e.g., npm for JavaScript ecosystems, PyPI for Python, Maven Central for Java) using keywords such as "Approov" or "Application Environment Verification." It is important to note that community libraries may not carry the same level of support or security guarantees as official SDKs. Developers are advised to assess the maturity, maintenance, and security practices of any third-party library before incorporating it into a production environment. For critical applications, relying on and contributing to the official Application Environment Verification SDKs and documentation is recommended.