Client app integration

1. What Super Admin sends you

Never mix Sandbox and Production. Production credentials stay locked until Checkers approve go-live.

• Client Admin at https://client.{company}.appdefender.dev
• Private registry .npmrc fragment and a read token — put the token in CI as APPDEFENDER_TOKEN. Do not commit it.
• Sandbox mobile: App ID + rnsh_sbx_…
• Sandbox web: pa_web_sbx_… and allowed QA domains
• ATS host, current + next pins, Android package / iOS bundle

2. Install (npm or Yarn)

Paste the exact .npmrc Super Admin issues, then install with npm or Yarn. Do not invent a registry URL.

# .npmrc — paste the fragment Super Admin issues (npm and Yarn both read this)
# @appdefenderdev:registry=<PRIVATE_REGISTRY_URL>
# //<PRIVATE_REGISTRY_HOST>/:_authToken=${APPDEFENDER_TOKEN}

# —— React Native ——
npm install @appdefenderdev/sdk.react-native@1.0.5
npm install @appdefenderdev/sdk.integration.mobile@1.0.6
# or
yarn add @appdefenderdev/sdk.react-native@1.0.5
yarn add @appdefenderdev/sdk.integration.mobile@1.0.6
cd ios && pod install && cd ..

# —— Website / Ionic website ——
npm install @appdefenderdev/sdk.web@1.0.4
npm install @appdefenderdev/sdk.integration.web@1.0.4
# or
yarn add @appdefenderdev/sdk.web@1.0.4
yarn add @appdefenderdev/sdk.integration.web@1.0.4

# —— Ionic store app (Capacitor) ——
npm install @appdefenderdev/sdk.capacitor@1.0.2
# or
yarn add @appdefenderdev/sdk.capacitor@1.0.2
npx cap sync

# —— Cordova / older Ionic ——
cordova plugin add @appdefenderdev/sdk.cordova@1.0.3

Flutter, CDN, and legacy names

Flutter: Super Admin sends the private appdefender path. Add it in pubspec.yaml (not pub.dev). Website CDN (no private token): https://sdk.appdefender.dev/web/v1/appdefender.min.js. Local lab: http://127.0.0.1:3200/sdk/web/v1/appdefender.min.js.

Do not use legacy names @appdefender/react-native, @appdefender/web, or unversioned @1.0.1 — those are not the signed Client packages.

3. Mobile — Gate 1 at process start

Pass the Super Admin Android packageName and iOS bundleId in initialize. Copy App.appdefender.tsx, Android ProGuard + TLS config, and the iOS Privacy Manifest from @appdefenderdev/sdk.integration.mobile. React Native 0.76+, Android 8 (API 26), iOS 15. Offline Threat Handling is mandatory. Catalogs stay isolated — 44 Android rules, 23 iOS rules.

import AppDefender from "@appdefenderdev/sdk.react-native";

await AppDefender.initialize({
  appId: "CLIENT_APP_ID",
  environment: __DEV__ ? "sandbox" : "production",
  appName: "Wallet App",
  packageName: "com.appdefender.xyz",
  bundleId: "com.appdefender.xyz",
  offlineThreatHandling: {
    enabled: true,
    failMode: "BLOCK",
    useCachedPolicy: true,
    localDetection: true,
  },
});

const launch = await AppDefender.launchSecurityCheck();
if (launch.decision === "BLOCK") return;
if (launch.decision === "RESTRICT") return;
// ALLOW — login next

React Native SDK

4. Mobile — KeysDefender and Gate 2

Do not put Client SDK keys in JavaScript. Do not send the raw access token to ATS. Your API must still authorize.

const key = await AppDefender.getKey("MOENGAGE_APP_KEY");
// { released, keyName, reason } — never the secret
await AppDefender.KeysDefender.initializeSDK("MOENGAGE");
await AppDefender.KeysDefender.initializeSDK("GOOGLE_MAPS");

const lite = await AppDefender.evaluateApi({
  method: "GET",
  path: "/balance",
  accessToken,
  atsMode: "LITE",
});
if (lite.decision !== "ALLOW") return;
await clientApi.getBalance({ Authorization: `Bearer ${accessToken}` });

KeysDefender

5. Web — session gate

Same Gate 1 on @appdefenderdev/sdk.web, /react, /nextjs, /angular, /vue, and /svelte. A Production App ID on an unlisted host is DOMAIN_MISMATCH.

import { AppDefenderGate } from "@appdefenderdev/sdk.web/nextjs";
// React:    @appdefenderdev/sdk.web/react
// Angular:  appDefenderInitializer from @appdefenderdev/sdk.web/angular
// Vue:      runGate from @appdefenderdev/sdk.web/vue
// Svelte:   startAppDefender from @appdefenderdev/sdk.web/svelte
// Vanilla:  @appdefenderdev/sdk.web

<AppDefenderGate appId="pa_web_sbx_…" environment="sandbox" appName="Client website">
  {/* first screen */}
</AppDefenderGate>

await AppDefender.initialize({ appId: "pa_web_sbx_…", environment: "sandbox" });
const launch = await AppDefender.launchSecurityCheck();
if (launch.decision === "BLOCK") return;

const decision = await AppDefender.authorize({ action: "PAYMENT" });
// advisory only — the Client API must authorize

Web SDK

6. Your API

Validate your token or cookie. Confirm ATS returned ALLOW for the request. Deny on BLOCK, LOCK, or REVOKE even when the token is valid.

Checklists

Sandbox: install the private package, launch / init before UI, confirm ALLOW on the sandbox dashboard, prove BLOCK on a compromised device, Lite then Full on APIs, deny when ATS is not ALLOW.

Production: Checker-approved policy, production credentials only, native module present, current + next pins, no sandbox keys in the store binary.