Which platforms does the SDK support?

Native iOS and Android, plus Flutter. It adds a few hundred kilobytes to the app and runs on every install and every tracked event.

What kind of install fraud does it catch?

Emulators and device farms, rooted and jailbroken devices, repackaged apps, click injection, click spam, SDK spoofing and install hijacking, using device, behavioural and connection signals.

Does it replace my MMP?

No. It works alongside AppsFlyer, Adjust and others by labelling installs and events before they are attributed. If you do not want a separate MMP bill, ClickTrust's Lite-MMP Attribution is built in.

What happens to a fraudulent install?

It is flagged with a risk band and its evidence, excluded from your event stream, and the device can be blocklisted so it never counts again.

How long does setup take?

Add the SDK, initialise it with your account key and track the standard event taxonomy (install, purchase, login and so on). Most teams finish in an afternoon.

Layer 2 · In-App Protection

Protect your app install and event spend the same way you protect web.

Native iOS, Android, and Flutter SDK that scans every install, session, and conversion event against the same rule engine that powers ClickTrust's web protection — plus 24+ in-app-specific traps for jailbreak, emulators, repackaged apps, click-injection, and click farms. One workspace, one fraud score, three layers of paid media protected.

Get the SDK Read the docs

What it catches

In-app fraud has different signals than web

Mobile traffic doesn't have referers, doesn't have browser fingerprints, and runs in a sandboxed app process. That breaks every web-only fraud tool. Our SDK reads the signals your OS does expose, then runs them through trap categories tuned for in-app behaviour.

Anti-detect

Rooted (Magisk, SuperSU), jailbroken, Frida instrumentation, Xposed/LSPosed hooks, debugger attached, repackaged/resigned bundle.

Emulator & device fingerprint

Identical hardware clusters, AAID/IDFA reset velocity, virtual sensor patterns, headless WebView identifiers.

Behavioural

Zero-dwell sessions, orientation-locked click bursts, click-without-gesture, no foreground time before conversion.

Viewability (MRC mobile)

Below 50%/1s viewability threshold, background ad serves, mostly-hidden WebView, ad stacking inside the WebView.

Identity & platform

Android package in iOS UA, WebView/Chrome version mismatch, suspicious X-Requested-With, known-fraud apps.

Connection

Native VPN detection, datacenter IP, carrier-grade NAT awareness, geo-timezone mismatch from emulator farms.

How it works

Drop the SDK in. Track events. We do the rest.

Add the native SDK to your iOS, Android, or Flutter project (one Gradle line / one CocoaPod / one pubspec line). Configure your account ID + SDK secret. Every cold-start, foreground, and event you fire from ClickTrust.trackEvent() hits our pipeline — HMAC-signed, batched, and deduplicated.

Auto-fires install, first_open, session_start, update
Standard event taxonomy: purchase, login, signup, add_to_cart, …
HMAC-SHA256 signing prevents on-device spoofing
externalId for idempotent server-to-server reconciliation

Flutter example

import 'package:clicktrust_flutter/clicktrust.dart';

await Clicktrust.configure(
  accountId: 42,
  trackingId: 'abcd1234',
  sdkSecret: const String.fromEnvironment('CT_SDK_SECRET'),
);

// Auto-events fire on configure(): install,
// first_open, session_start, update.
//
// Custom events:
await Clicktrust.trackEvent(
  'purchase',
  amount: 99.0,
  currency: 'USD',
  externalId: 'order_2026_4123',
);

Built for advertisers, not networks

Three things you'll do with In-App Protection

See which app events are real

Filter the Traffic page to fraud-only and learn what's draining your CPI. No more arguing with networks about install quality.

Block bad devices forever

When the SDK catches a rooted device or click farm cluster, the device-ID hash auto-lands on your in-app blocklist. Export to CSV / PDF for evidence.

Combine with web + attribution

If you also run web campaigns or affiliate offers, all three layers share one workspace, one fraud score, and one set of reports.

FAQ

Questions advertisers ask before switching on In-App Protection.

Which platforms does the SDK support?: Native iOS and Android, plus Flutter. It adds a few hundred kilobytes to the app and runs on every install and every tracked event.
What kind of install fraud does it catch?: Emulators and device farms, rooted and jailbroken devices, repackaged apps, click injection, click spam, SDK spoofing and install hijacking, using device, behavioural and connection signals.
Does it replace my MMP?: No. It works alongside AppsFlyer, Adjust and others by labelling installs and events before they are attributed. If you do not want a separate MMP bill, ClickTrust's Lite-MMP Attribution is built in.
What happens to a fraudulent install?: It is flagged with a risk band and its evidence, excluded from your event stream, and the device can be blocklisted so it never counts again.
How long does setup take?: Add the SDK, initialise it with your account key and track the standard event taxonomy (install, purchase, login and so on). Most teams finish in an afternoon.

Running affiliate / paid-network installs?

Pair In-App Protection with Lite-MMP attribution to see which affiliate, source, or network is sending the fraud — and stop their postback before payout.

Learn about Lite-MMP

Learn about Web See pricing