React Native SDK reference

@revokegpt/react-native returns a RevokeGPT token from a React Native app on iOS and Android. It is a TurboModule over the native iOS and Android SDKs, which do the proof of work, App Attest (iOS) or Play Integrity (Android), and show the hosted challenge sheet when your site’s rules ask for one. Your server verifies the token with siteverify. For a walkthrough, see the React Native quickstart.

Package version: 0.1.0, the same as the native SDKs. Requires React Native 0.88.1 or later with the New Architecture, React 19.3 or later, iOS 15.1 or later and Android 7.0 (API 24) or later. On the old architecture every call fails with an error that names the New Architecture.

Install

npm install @revokegpt/react-native   # after the first release
cd ios && pod install

The package is native code: rebuild the app after installing. A JavaScript reload is not enough. If the module is missing from the build, every call fails with internal and a message that says so.

import { RevokeGPT, RevokeGPTError } from '@revokegpt/react-native';

For Expo, use a development build (npx expo prebuild or EAS Build). Expo Go is not supported. The config plugin adds the App Attest entitlement:

{
  "expo": {
    "plugins": [["@revokegpt/react-native", { "appAttestEnvironment": "production" }]]
  }
}

appAttestEnvironment is production (the default) or development. Any other value fails expo prebuild. The plugin changes nothing on Android.

Options

RevokeGPT.configure takes one Configuration object. Each field is checked in JavaScript before any native call, and a malformed one rejects with invalid-argument.

Option	Type	Default	Notes
`siteKey`	`string`	required	Your public site key: `rgpk_` and 20 letters and digits.
`endpoint`	`string`	`https://api.revokegpt.com`	The API origin. `https:`; plain `http:` to a loopback host works in debug builds only. At most 2048 characters, no whitespace or backslash.
`widgetOrigin`	`string`	`https://js.revokegpt.com`	The hosted challenge page’s origin. Same rules as `endpoint`.
`timeoutMs`	`number`	`10000`	The total deadline of one call, an integer from 1000 to 60000.
`cloudProjectNumber`	`string`	none	Android: your Google Cloud project number as a decimal string. Without it Play is skipped. iOS ignores it.
`locale`	`string`	the device’s	The hosted page’s language, such as `en` or `pt-BR`.
`theme`	`'light' \| 'dark' \| 'auto'`	`auto`	The hosted page’s theme.
`keyScope`	`string`	none	iOS: an opaque id of the signed-in account, 1 to 1024 bytes of UTF-8, for one App Attest key per account. Only a keyed hash is stored; use an opaque value, not an email. Android ignores it.
`debugLogging`	`boolean`	`false`	Logs event names, never values, natively.

Methods

RevokeGPT is a frozen object; it is also the default export.

`RevokeGPT.configure`

configure(c: Configuration): Promise<void>

Configures the native SDK. A later call replaces the configuration. Rejects with invalid-argument for a malformed setting, and with busy while a call is running.

await RevokeGPT.configure({ siteKey: 'rgpk_...', cloudProjectNumber: '123456789012' });

`RevokeGPT.execute`

execute(options?: { action?: string; cdata?: string }): Promise<string>

Returns a RevokeGPT token. When the site’s rules ask for a puzzle, the hosted page is shown over the app in a native sheet, and the call returns when the person finishes or closes it.

Parameter	Rules
`action`	1 to 100 characters of `A-Z a-z 0-9 / _`.
`cdata`	0 to 255 characters of `A-Z a-z 0-9 _ -`.

Resolves with the token. Send it to your server, which verifies it with siteverify.

try {
  const token = await RevokeGPT.execute({ action: 'login' });
  // send `token` to your server with the request
} catch (e) {
  if (e instanceof RevokeGPTError) {
    // e.code: 'challenge-required', 'cancelled', 'rate-limited', ...
  }
}

`RevokeGPT.challengeAccount`

challengeAccount(requestToken: string, options?: { languageCode?: string }): Promise<string>

Account verification for the request token your server got from RevokeGPT. requestToken is 1 to 2048 characters of A-Z a-z 0-9 _ -. languageCode is a language code of up to 35 characters. Resolves with the hosted page’s token. See account protection.

Other exports

RevokeGPTError, RevokeGPTModuleMissingError, the code lists ERROR_CODES, OWN_ERROR_CODES and API_ERROR_CODES, and the types Configuration, Theme and RevokeGPTErrorCode.

Errors and failure model

Every failure is a RevokeGPTError (a subclass of Error):

Field	Type	Meaning
`code`	`RevokeGPTErrorCode`	One of the codes below.
`status`	`number`	The HTTP status (100 to 599), or `0` when there was none.
`requestId`	`string \| undefined`	The server’s request id, only when well-formed.
`retryAfterSeconds`	`number \| undefined`	`Retry-After` on a 429 or 503, 0 to 3600.

message is fixed: RevokeGPT error: <code>. No native or server text, token or site key reaches JavaScript. The one exception is RevokeGPTModuleMissingError, a RevokeGPTError with code internal whose message says the TurboModule is not in the build.

Code	Meaning
`invalid-argument`	A setting or argument is malformed.
`not-configured`	`execute` before `configure`.
`network-error`	No connection, a TLS failure or a refused connection.
`timeout`	The call’s deadline passed.
`http-error`	A non-200 answer without a known error, or a redirect (never followed).
`invalid-response`	The server’s answer was not valid, or named another app.
`challenge-required`	A challenge is needed and could not be shown (no screen to show it on).
`challenge-unsupported`	The device cannot show the challenge safely.
`cancelled`	The person closed the challenge, or the React instance went away (a reload, or teardown).
`busy`	`configure` during a call, or a second sheet while one is up.
`internal`	An unexpected state, or an unknown native code.

API error codes are passed through unchanged, for example rate-limited, invalid-site-key, app-not-allowed and plan-required. See error codes. Treat every failure as “do not accept” for the action you are protecting.

Configuration

iOS: add the App Attest capability to your app target. Its entitlement com.apple.developer.devicecheck.appattest-environment is production for App Store and TestFlight builds and development while you develop. Register the bundle id on your site in the dashboard.
Android: link Play Integrity to your Google Cloud project in the Play Console, register the package name in the dashboard, and pass cloudProjectNumber.
Where attestation is unavailable (the iOS Simulator, an emulator without Play), the SDK still returns a token, but it carries no full attestation and RevokeGPT gives it a lower score.

Security notes

The token is only a claim until your server verifies it. Verify with siteverify and your secret key (rgsk_...) on the server, never in the app. Verify app tokens with expectedApp, not a hostname.
The site key is public. The secret key must never be in the app.
Never pass a token or secret to JavaScript through initial props: in debug builds React Native logs every initial property to the device log.
The package adds nothing to what the native SDKs send and store: your site key, the app’s bundle id or package name, the action and cdata you pass, the proof of work and the attestation result. The sdk field names this package (revokegpt-react-native and its version); the server treats it as untrusted telemetry. On iOS the only stored item is the App Attest key id, in the Keychain. Android stores nothing.

See also the React Native quickstart and mobile attestation.