React Native SDK

Client path

Full Client path (private package, web + mobile, backend): Client integration. Client packages use @appdefenderdev/sdk.* only — never legacy @appdefender/*.

Client integration

Install

Optional mobile kit (copy Gate 1 samples): npm install @appdefenderdev/sdk.integration.mobile@1.0.6 or yarn add @appdefenderdev/sdk.integration.mobile@1.0.6.

# .npmrc — paste the fragment Super Admin issues (npm and Yarn)
# Then:

# npm
npm install @appdefenderdev/sdk.react-native@1.0.5

# Yarn
yarn add @appdefenderdev/sdk.react-native@1.0.5

cd ios && pod install

# Autolinks AppDefenderNative (Android Gradle + iOS CocoaPods).
# Native cores own detection and enforcement.
# Production without the native module fails closed.

Client SDK packages

Signed packages are @appdefenderdev/sdk.* only. Never use legacy @appdefender/*.

Initialize

import AppDefender from '@appdefenderdev/sdk.react-native';

AppDefender.initialize({
  appId: 'CLIENT_APP_ID',
  environment: 'production',
  offlineThreatHandling: {
    enabled: true,
    failMode: 'BLOCK',
    useCachedPolicy: true,
    localDetection: true,
  },
  dependencyCallback: (event) => {
    // OFFLINE_MODE | ONLINE_MODE | THREAT_DETECTED | POLICY_EXPIRED | ALLOW | BLOCK | RESTRICT
  },
});

Launch Security Gate (native, before UI)

The gate runs in the Native Security Core before React Native UI is trusted. JavaScript receives the result for UI coordination only. It does not decide ALLOW / RESTRICT / BLOCK.

const result = await AppDefender.launchSecurityCheck();

if (result.decision === 'BLOCK') {
  // Do not allow protected application features
  return;
}

if (result.decision === 'RESTRICT') {
  // Allow only permitted functionality
  return;
}

// ALLOW — continue application startup

AppDefender.getSecurityState();
AppDefender.onSecurityEvent((event) => {
  if (event.decision === 'BLOCK') {
    // Lock/hide protected RN screens — native already enforced
  }
});

Offline vs online

Offline uses the last securely provisioned policy plus local detection (device integrity, root/jailbreak, debugger, emulator, Frida/hooking, tamper, code integrity, app signature, key integrity).

Offline Threat Handling

OTP (after initialize)

Public App ID only. PE ID, DLT templates, and SMS keys stay on the API.

const start = await AppDefender.auth.requestOtp({
  phoneNumber: '+91XXXXXXXXXX',
  purpose: 'LOGIN',
});
await AppDefender.auth.verifyOtp({ requestId: start.requestId, otp });

DLT, OTP, and SMVDefender

KeysDefender (after ALLOW)

Do not put Firebase, MoEngage, Juspay, Google Maps, or payment keys in JavaScript. Super Admin vaults them. Native CryptoEngine uses SHA-256 and AES-256-GCM.

const key = await AppDefender.getKey('MOENGAGE_APP_KEY');
// { released, keyName, reason } — never the secret

await AppDefender.KeysDefender.initializeSDK('MOENGAGE');
await AppDefender.KeysDefender.initializeSDK('GOOGLE_MAPS');
await AppDefender.KeysDefender.initializeSDK('JUSPAY');

KeysDefender

APIs (after ALLOW, then login)

const envelope = await AppDefender.createEnvelope({ route: '/payment' });
const ats = await AppDefender.evaluateApi(envelope);
// ATS Lite or Full from Client Admin ApiDefender rules
// Token alone never overrides BLOCK

Platform rules

• Network availability never overrides BLOCK.
• A valid access token never overrides BLOCK.
• Client SDK keys go through KeysDefender — not raw JavaScript.
• Install only @appdefenderdev/sdk.react-native (never @appdefender/react-native).