Integrity Check
Verify app integrity at runtime
Overview
Unveily automatically verifies at runtime that the app has not been tampered with and was installed through an official app store. Android uses the Google Play Integrity API and iOS uses App Attest + DeviceCheck. On both platforms this runs inside the SDK core as part of license verification.
iOS Integrity Verification
Integrity verification is implemented on iOS as well. iOS uses Apple's App Attest and DeviceCheck APIs to automatically perform verification equivalent to Android's Play Integrity. On both platforms the check runs inside the SDK core, and the integrity token is never exposed to JavaScript.
Developers do not need to write any code. The SDK automatically performs integrity verification when the app starts.
| Verification Item | Description |
|---|---|
| App tampering | Checks if the app binary matches the original build |
| Install source | Checks if it was installed normally via an official store (Google Play / App Store) |
| Device state | Checks the basic security state of the device |
You Don't Configure Anything
Integrity verification is performed automatically by the SDK as part of Unveily's license protection. There is nothing for you to set up in Play Console or Google Cloud for Unveily's integrity check. (The integrity token is handled entirely inside the SDK and is never exposed to JavaScript.)
Your own app's Play Integrity is completely separate
If you want to use Play Integrity (Android) or App Attest (iOS) directly for your own app's security, set it up independently in your own Google Cloud project. That is completely separate from Unveily SDK's integrity check and does not go through the SDK or Unveily's servers. (If you use Firebase, Firebase App Check — which uses Play Integrity under the hood — is the simplest way to protect your backend.) Play Integrity is designed to allow multiple Cloud projects within a single app, so the two verifications run side by side on the same device without interfering with each other.
How Integrity Verification Works
Integrity verification is handled automatically between the SDK core and Unveily's backend. During license verification the SDK generates an integrity token (Play Integrity on Android, App Attest + DeviceCheck on iOS), sends it directly to Unveily's servers, and the server verifies it.
There is no JS API to fetch the integrity token
There is no Bridge method to obtain the integrity token from JavaScript. The token is handled entirely inside the SDK and is never exposed to web code. You therefore do not need to write any code to fetch the token and decode it on your server (for example, by calling the Play Integrity API directly) — and that approach is not supported.
You do not need to write any code. Integrity verification happens entirely between the SDK and Unveily's servers.