SDK key protection

Do not ship encrypted keys with the decryptor

Encrypting a MoEngage, Firebase, or Maps key and embedding both the ciphertext and the AES key in the binary is not KeysDefender. An attacker extracts both. Super Admin vaults the secret with envelope encryption. Native unwrap runs only after launchSecurityCheck returns ALLOW.

Client integration

securityCheck is an alias of launchSecurityCheck. Prefer launchSecurityCheck. getKey returns released / keyName / reason — never the AES material.

import AppDefender from '@appdefenderdev/sdk.react-native';

await AppDefender.initialize({
  appId: 'CLIENT_APP_ID',
  environment: 'sandbox', // or production
});

const status = await AppDefender.launchSecurityCheck();
if (status.decision !== 'ALLOW') return;

// Metadata only — never the secret
const key = await AppDefender.getKey('MOENGAGE_APP_KEY');
// { released, keyName, reason }

await AppDefender.KeysDefender.initializeSDK('MOENGAGE');

React Native SDK

What the app receives

A signed KP1 token — Client, app, SDK, key id, version, environment, expiry — not MOENGAGE_KEY = "actual-secret". Native CryptoEngine unwraps with AES-256-GCM into Keystore / Keychain (SHA-256 / AES-256-GCM baseline).

CryptoEngine

Supported vault types (Super Admin)

KeysDefender catalog names match the Super Admin vault. Use these SDK ids with KeysDefender.initializeSDK and the matching key names with getKey:

• GOOGLE_MAPS — GOOGLE_MAPS_ANDROID_KEY / GOOGLE_MAPS_IOS_KEY (or GOOGLE_MAPS_API_KEY for BOTH)
• MOENGAGE — MOENGAGE_APP_KEY
• FIREBASE — FIREBASE_APP_KEY
• JUSPAY / PAYMENT — JUSPAY_APP_KEY / PAYMENT_APP_KEY
• ANALYTICS, CleverTap, Branch, AppsFlyer, Amplitude, KYC, Custom — {SDK}_APP_KEY

Google Maps

Treat the Maps SDK key like MoEngage. Super Admin vaults an Android key (GOOGLE_MAPS_ANDROID_KEY, restrict by package + SHA-1) and an iOS key (GOOGLE_MAPS_IOS_KEY, restrict by bundle ID). Do not put an AIza… value in JavaScript, AndroidManifest.xml, or Info.plist as the source of truth.

const maps = await AppDefender.getKey('GOOGLE_MAPS_ANDROID_KEY');
// { released, keyName, reason } — Maps key stays in Keystore

await AppDefender.KeysDefender.initializeSDK('GOOGLE_MAPS');
// aliases: MAPS also resolve to GOOGLE_MAPS

Payments & money movement

BLOCK never releases payment keys. A valid access token cannot override KEY_RELEASE DENIED after LAUNCH_BLOCK.

await AppDefender.KeysDefender.initializeSDK('JUSPAY');
// or initializeSDK('PAYMENT')

const pay = await AppDefender.getKey('JUSPAY_APP_KEY');
// released only when launch decision is ALLOW

Platform rules

• KEY_RELEASE is DENIED when launch is BLOCK (LAUNCH_BLOCK).
• A valid access token never releases a key after BLOCK (TOKEN_CANNOT_OVERRIDE).
• Client Admin dashboards never list plaintext SDK secrets.
• Sandbox and Production vaults stay isolated — never share KP1 material across environments.
• Google Maps, MoEngage, Juspay, Firebase, and analytics use the same Super Admin vault, envelope, and native-only unwrap.