Flutter quickstart

1. Create a site

In the dashboard, create a site and add your app under Apps. Copy the site key (rgpk_..., public) and the secret key (rgsk_..., shown once, server only). Choose the mode: invisible, checkbox or score (modes and thresholds).

2. Add the client

Not published yet

The revokegpt Flutter plugin is not on its registry yet, so install it from a checkout of the repository as below. After the first release the registry command applies.

dependencies:
  revokegpt:
    path: ../path/to/sdks/flutter     # until the first release; then: revokegpt: 0.1.0

The plugin wraps the native iOS and Android SDKs, so the same setup applies: add the App Attest capability on iOS, set up Play Integrity on Android and pass cloudProjectNumber (ignored on iOS), and add both apps under Apps in the dashboard. Requires iOS 15 or later, Android 7.0 (API 24) or later, and Flutter 3.47.9 or later. Do not also link the native iOS SDK into the same app. See the iOS and Android pages for the platform setup.

3. Verify the token on your server

undefined

signup.dart

import 'package:revokegpt/revokegpt.dart';

Future<void> configureRevokeGPT() async {
  await RevokeGPT.configure(siteKey: 'rgpk_...', cloudProjectNumber: '123456789012');
}

Future<String?> signupToken() async {
  try {
    return await RevokeGPT.execute(action: 'signup'); // send it to your server
  } on RevokeGPTException catch (e) {
    print('revokegpt error ${e.code}'); // never retry in a tight loop
    return null;
  }
}

4. Read the score and the reasons

siteverify returns success, a score from 0.0 (bot) to 1.0 (human) in steps of 0.1, the action and hostname (or app) the token was issued for, and reasons, a list such as AUTOMATION or DATACENTER_IP. Always check success, the action and the hostname, then compare the score with a threshold you choose. 0.5 is a sensible start. For an app token use a threshold of 0.6 or higher: 0.5 is the cap for a token with no attestation evidence (a Simulator or emulator, a device without Google Play, or any script that claims one of these). See scores and reason codes and modes and thresholds.

5. Go live

• The secret key is in your server’s secret store, not in source control, a page or an app.
• The server checks success, the expected action, the expected hostname (or app) and a minScore.
• A refused or failed verification blocks the action. Treat every failure as “do not accept”.
• The token is sent over HTTPS and used once; a retry needs a new token.
• Your site’s allowed domains (or apps) in the dashboard list the real production hostnames.
• On the server, verify app tokens with expectedApp (platform and bundle id or package name), never with a hostname, and never choose between the two from anything the client controls.
• Your Content Security Policy allows the widget origin if you have one (see session tokens and cookies).