Request
AppDefender.auth.requestOtp sends phone and purpose. The API hashes the code and queues SMS through DLT.
App Security · AppDefender.dev
SMVDefender
Identity verification beside SMS OTP and SMSV.
SMVDefender is AppDefender identity verification beside SMS OTP and SMSV. The Client app calls requestOtp with a public App ID. PE ID, header, template, and SMS secrets stay on the API. A compromised handset with a valid OTP is still BLOCK.
SMVDefender identity check
SMS OTP + SMSV
DLT on the server
No secrets in the SDK
OTP ignored after BLOCK
Maker–Checker Production
What it does
SMVDefender on the launch path
SMVDefender sits on the identity path with MFADefender and BindDefender. Use this name only — never AppSMV.
The app never talks to an SMS gateway. App → SDK → API → attestation → risk → OTP → DLT → provider. PE ID is a string up to 32 characters, not a BIGINT.
Remote policy chooses SMS OTP, SMSV, or SMVDefender without an SDK rebuild. Super Admin and Client Admin register DLT with Maker–Checker before Production.
What it scores
Signals this module is built for
- SMS OTP generated on the server — hash stored, not plaintext
- SMSV beside the OTP
- SMVDefender identity confidence
- No PE ID, header, or SMS key in the Client app
- Launch BLOCK still wins over a valid OTP
- Maker–Checker on PE, header, template, and Production
How it runs
Detect, decide, enforce
Verify
AppDefender.auth.verifyOtp checks the hash, attempt count, and expiry. Secrets never leave the server.
Risk
SMS OTP + SMSV + SMVDefender score identity. A rooted or hooked handset still fails the launch gate.
Operators
Who owns the control
Super Admin
Registers PE ID, headers, templates, and SMS secret refs. Production stays closed until checkers approve.
Client Admin
Operates DLT and OTP policy for that company only. Cannot put SMS keys in the SDK.
Other App Security modules
Read the product page, not a copy here
All modules