Android quickstart

1. Create a site

In the dashboard, create a site and add your app under Apps. Copy the site key (rgpk_..., public) and the secret key (rgsk_..., shown once, server only). Choose the mode: invisible, checkbox or score (modes and thresholds).

2. Add the client

Not published yet

The RevokeGPT Android SDK is not on its registry yet, so install it from a checkout of the repository as below. After the first release the registry command applies.

Include sdks/android as a composite build in settings.gradle.kts, then depend on it:

includeBuild("../path/to/sdks/android") {
    dependencySubstitution {
        substitute(module("com.revokegpt:revokegpt-android")).using(project(":revokegpt"))
    }
}
// app module
dependencies { implementation("com.revokegpt:revokegpt-android:0.1.0") }

Set up Play Integrity: link a Google Cloud project in the Play Console and turn on the Play Integrity API, add your app’s package name and signing-certificate SHA-256 under Apps in the dashboard, upload the service account’s JSON key, and pass the project number as cloudProjectNumber. Without it the SDK does not call Play, and the token’s score is capped (0.5 by default). Requires Android 7.0 (API 24); the only permission is INTERNET.

3. Verify the token on your server

undefined

Signup.kt

import android.app.Application
import com.revokegpt.android.RevokeGPT
import com.revokegpt.android.RevokeGPTException
import com.revokegpt.android.RevokeGPTOptions

class App : Application() {
    override fun onCreate() {
        super.onCreate()
        RevokeGPT.init(
            this,
            "rgpk_...",
            RevokeGPTOptions(cloudProjectNumber = 123456789012L), // your Google Cloud project number
        )
    }
}

// For each protected action, in a coroutine.
suspend fun signupToken(): String? =
    try {
        RevokeGPT.execute(action = "signup") // send it to your server with the request
    } catch (e: RevokeGPTException) {
        println("revokegpt error ${e.code}") // never retry in a tight loop
        null
    }

4. Read the score and the reasons

siteverify returns success, a score from 0.0 (bot) to 1.0 (human) in steps of 0.1, the action and hostname (or app) the token was issued for, and reasons, a list such as AUTOMATION or DATACENTER_IP. Always check success, the action and the hostname, then compare the score with a threshold you choose. 0.5 is a sensible start. For an app token use a threshold of 0.6 or higher: 0.5 is the cap for a token with no attestation evidence (a Simulator or emulator, a device without Google Play, or any script that claims one of these). See scores and reason codes and modes and thresholds.

5. Go live

• The secret key is in your server’s secret store, not in source control, a page or an app.
• The server checks success, the expected action, the expected hostname (or app) and a minScore.
• A refused or failed verification blocks the action. Treat every failure as “do not accept”.
• The token is sent over HTTPS and used once; a retry needs a new token.
• Your site’s allowed domains (or apps) in the dashboard list the real production hostnames.
• On the server, verify app tokens with expectedApp (platform and bundle id or package name), never with a hostname, and never choose between the two from anything the client controls.
• Your Content Security Policy allows the widget origin if you have one (see session tokens and cookies).