React Native quickstart

1. Create a site

In the dashboard, create a site and add your app under Apps. Copy the site key (rgpk_..., public) and the secret key (rgsk_..., shown once, server only). Choose the mode: invisible, checkbox or score (modes and thresholds).

2. Add the client

npm install @revokegpt/react-native     # after the first release

Until then build the tarball from sdks/react-native (pnpm run pack:prepare, then npm pack) and install it, and publish the Android SDK to a local Maven repository; the package README has the steps. The package is native code, so rebuild the app after installing. React Native 0.88.1 or later, New Architecture only; iOS 15.1 or later and Android 7.0 (API 24) or later. App Attest and Play Integrity setup is the same as on iOS and Android.

3. Verify the token on your server

undefined

import { RevokeGPT, RevokeGPTError } from '@revokegpt/react-native';

export async function configureRevokeGPT(): Promise<void> {
  await RevokeGPT.configure({ siteKey: 'rgpk_...', cloudProjectNumber: '123456789012' });
}

export async function signupToken(): Promise<string | null> {
  try {
    return await RevokeGPT.execute({ action: 'signup' }); // send it to your server
  } catch (e) {
    if (e instanceof RevokeGPTError) console.warn('revokegpt error', e.code);
    return null;
  }
}

4. Read the score and the reasons

siteverify returns success, a score from 0.0 (bot) to 1.0 (human) in steps of 0.1, the action and hostname (or app) the token was issued for, and reasons, a list such as AUTOMATION or DATACENTER_IP. Always check success, the action and the hostname, then compare the score with a threshold you choose. 0.5 is a sensible start. For an app token use a threshold of 0.6 or higher: 0.5 is the cap for a token with no attestation evidence (a Simulator or emulator, a device without Google Play, or any script that claims one of these). See scores and reason codes and modes and thresholds.

5. Go live

The secret key is in your server’s secret store, not in source control, a page or an app.
The server checks success, the expected action, the expected hostname (or app) and a minScore.
A refused or failed verification blocks the action. Treat every failure as “do not accept”.
The token is sent over HTTPS and used once; a retry needs a new token.
Your site’s allowed domains (or apps) in the dashboard list the real production hostnames.
On the server, verify app tokens with expectedApp (platform and bundle id or package name), never with a hostname, and never choose between the two from anything the client controls.
Your Content Security Policy allows the widget origin if you have one (see session tokens and cookies).