Approov Product Overview

API Security for the Mobile App Age

If you connect with your customers through a mobile app, that connection needs to be secure. With Approov, you’ll have a real-time shielding solution built in and around your app. It will protect the backend API services your app accesses, ensuring only your official app, running in a trusted environment, can successfully use those services.

Protection of API calls and data is now essential for business. Insecure APIs leave open the possibility of data breaches, fraud, denial of service, and other forms of API abuse which can impact your revenue and damage your brand. Approov Mobile App Protection provides three critical security benefits to your business:

App Attestation

Ensures a genuine and authentic app is accessing your backend service, not a bot, tampered or repackaged app.

Environment Checks

Detects unsafe operating environments, such as rooted/jailbroken devices, apps running under debuggers or emulators, or with malicious frameworks present on the client device.

Dynamic Pinning

Protects all API communications from third party observation or manipulation, with no risk of service interruption.

How It Works

Approov Mobile App Protection verifies your app's authenticity and runtime safety. Short lived cryptographic tokens are used to attest the authenticity to backend APIs and services, allowing them to reject any requests not coming from your official apps.

>

Capabilities

Positive app attestation

Man-in-the-middle rejection

User authorization binding

Dynamic certificate pinning

Easy app SDK integration

JWT backend token verification

Selective security policies

DeviceCheck integration

SafetyNet integration

Emulator detection

Debug detection

Root detection

Jailbreak detection

Magisk detection

Frida detection

Xposed detection

Cydia detection

Clone app detection

App automation detection

Memory dump detection

Real-time metrics

Over-the-air security updates

DevOps tooling

24/7/365 support

Start a Free Trial

Approov makes available a complimentary 30 day trial (no credit card necessary). Learn how easy it is to eliminate the threats against your apps and APIs.

Runtime App Protection

The drop-in Approov SDK measures the authenticity of a running app and the properties of the device environment. Comprehensive runtime protection is provided, detecting app tampering, jailbreaking, rooting, debugging, cloning, hooking and various other malicious actions. Secure over-the-air update capabilities ensure your apps running in the field are continuously updated to instantly block new threats as they emerge. Real time monitoring allows you to see the blocking of live attacks against your app.

Learn More

Mobile App Attestation

Protection approaches that just run inside your app are insufficient, since this code must execute in a potentially compromised app environment. Instead, Approov uses an advanced attestation technique, requiring a live, interaction between our Approov cloud service and the Approov SDK in your app. This performs a non-replayable integrity measurement process, where the running app must prove its authenticity and provide secured measurements of its running environment.

Learn More

Secure API Authentication

The Approov cloud service then responds on the basis of the measurements it received and the security policy you have set. Short lived cryptographically signed tokens, issued by the Approov service, are delivered to verified app instances so they can prove their authenticity to your backend APIs and services. API keys for 3rd party APIs can be also be securely delivered on a just-in-time basis for validly attesting apps.

Learn More

Dynamic Certificate Pinning

HTTPS/TLS works well in encrypting your app’s communications against snooping or manipulation, but hackers can still establish Man-in-the-Middle (MitM) attacks to compromise app secrets or reverse engineer your APIs. Approov’s dynamic pinning service defeats these attacks, locking down connections to a fixed set of backend certificates that you can configure. Even better, it also allows secure over-the-air instant pin updates with no management headaches or service disruption.

Learn More

Rapid Deployment

A range of frontend Quickstarts makes integration easy, supporting popular frameworks such as Flutter, React Native, Xamarin and Ionic as well as native app integrations. Our integrations implement dynamic pinning as well as automatic addition of Approov tokens or Approov secured API keys using network interceptors. Approov tokens are industry standard JWTs so have extremely wide library support for easy verification. Just verify at your CDN, WAF/gateway, API management system or in your server code using one of our backend Quickstarts.

Learn More

Also see the Approov White Paper Addressing the Security Trust Gap in a Mobile World.

Talk to a Security Expert

Give us 30 minutes and our security experts will show you how to protect your revenue and business data by deploying Approov to secure your mobile apps and your APIs

Talk to an Expert
Approov Consultation