Skip to main content

Android SDK

This guide adds runtime protection to an Android app and sends the first real event to the console. It takes about ten minutes.

1. Add the dependency​

The SDK is an Android library (AAR). Add it to your app module:

app/build.gradle.kts
dependencies {
    implementation("com.moatgator:sdk:0.1.0")
}
note

While the SDK is private, add it from the moatgator-hq/sdk-android package or a local .aar. Ask us for access.

2. Start the SDK​

Start it once, as early as possible — in your Application.onCreate():

App.kt
import com.moatgator.sdk.Moatgator
import com.moatgator.sdk.MoatgatorConfig
import com.moatgator.sdk.Threat

class App : Application() {
    override fun onCreate() {
        super.onCreate()
        Moatgator.start(this, MoatgatorConfig(
            apiKey = BuildConfig.MOATGATOR_KEY,               // console -> app -> Keys (scope: events:ingest)
            expectedSigningCertSha256 = setOf("b12e8e59..."), // apksigner verify --print-certs app-release.apk
            allowedInstallers = setOf("com.android.vending"), // optional: only the Play Store
        ))

        Moatgator.addListener { finding ->
            if (finding.threat == Threat.HOOKING || finding.threat == Threat.TAMPER) {
                PaymentGate.block()   // your decision, not ours
            }
        }
    }
}

Keep the key out of source control: read it from a Gradle property or the environment and expose it through BuildConfig.

3. Get your signing certificate hash​

The SDK flags a build signed with a different key (a re-packaged app). Pin your real certificate:

apksigner verify --print-certs app/build/outputs/apk/release/app-release.apk
# Signer #1 certificate SHA-256 digest: b12e8e59...

Put that value in expectedSigningCertSha256.

The Gradle plugin encrypts string literals in your app at build time, so URLs and keys don't sit in plain text in the .dex:

app/build.gradle.kts
plugins {
    id("com.android.application")
    id("com.moatgator.protect")
}

It runs only on release, after your code compiles and before R8. The decryptor is in the SDK; your app behaves exactly the same.

5. Check the build before you ship​

verify-build confirms, offline, that the package is ready for the Play Store and that protection is wired in — the SDK is linked, the native library covers every ABI, 64-bit libraries are 16 KB-aligned (required for Android 15+), and the signature is v2+:

npx moatgator verify-build app/build/outputs/bundle/release/app-release.aab

It exits with code 4 if something would block the release. Add it to CI right after the build step.

6. See it work​

Run the app on an emulator or a rooted device and watch the console. Within a minute you should see events under Threats and on the app's page, and the security score will tick up as the SDK starts sending real events.

On an Android 14 emulator, a fresh run reports the emulator at the top confidence level; with the Magisk app installed, root at 95%; and a re-signed release build flags tampering at 98% — while the original stays clean.

Notes​

  • The SDK never crashes your app. Every check is wrapped; a failure becomes "don't know", never an exception.
  • No personal data. The device becomes a rotating hash; the only permission is INTERNET.
  • Recheck interval. By default the SDK re-checks every 60 seconds, because instrumentation often attaches after launch. Tune it with recheckIntervalMs.
  • Next: tighten your policy one detection at a time, and route alerts to your team.