Skip to main content

Go Live

Going live should be a controlled transition from observation to enforcement. The safest approach is to monitor first, then enable blocking once the app and backend behavior are understood.

Monitor First​

Run the integration in a mode where invalid or missing Approov tokens are logged but not blocked. This lets you confirm that legitimate users are not being rejected because of configuration or rollout issues.

Use both backend logs and Approov metrics. They answer different questions: backend logs show what your API accepted or rejected, while Approov metrics show what the SDK and cloud service observed.

Enable Blocking​

When you are confident in the integration, enable backend blocking for requests that do not present a valid Approov token.

Move gradually if possible. Start with lower-risk endpoints or a limited release channel, then expand once the traffic looks healthy.

Review Key Configuration​

Before enforcing blocking broadly, review:

Issues related to the backend Approov token check integration.

1. Token Check Integration​

IssueDescription
Approov Token Secret is not Hardcoded:Never hardcode the Approov token secret in your code. If it has been leaked then change it with the Approov CLI.
Approov Token Check Fails for Requests Without Approov Token:When the Approov Token header is not present then the request cannot be trusted and an error response must be returned.
JWT Library Explicitly Sets Expected Algorithm:This algorithm is usually HS256. Some JWT libraries are vulnerable to the none algorithm attack of setting the JWT header to alg: none, thus making any token succeed in the check.
Approov Token Check Fails for Expired Tokens:Even if the Approov token has a valid signature it must not pass the check if the token has expired. The request must not be trusted and an error response must be returned.
Approov Token Check Fails for Invalid Signatures:You can use the Approov CLI to generate invalid tokens, see docs. Then use cURL, Insomnia or Postman to build and send the requests as if it was your mobile app. See some examples of using cURL requests with Approov tokens. Replace the URL with your own one and the token with the one you generated with the Approov CLI. Another option is to use a mobile app not registered with the Approov cloud service, because it will always get invalid Approov tokens.
Approov Token Check has a Bypass Mode:Bypass mode means the token check is performed but the request always succeeds, even when no token is presented. This is especially useful for when going to production for the first time with Approov until you are confident the traffic is being properly attested, and that all versions of the app being used have Approov integrated. This can also be used to temporarily bypass checks in an emergency situation.

These are only relevant if you are using explicit certificate pinning rather than the default managed trust roots.

IssueDescription
API Backend Production Domain has Been Tested:Relevant if you are using different API domains between development test and production. Ensure production endpoints have been tested, especially with respect to their pinning.
Geographically Distributed Servers use the Same Certificates:When you have an API backend that is distributed geographically it’s important to ensure that a pin is added for all the different certificate keys used by servers that handle the associated requests. If all the servers use the same certificate or use certificates signed with the same public key then a single pin will be sufficient. If there are certificates signed with different keys then a pin must be added for each of the different keys that are used, see Adding an Explicit Pin.
Enable Approov Monitoring on APIs for Email Warnings when Pins Change:See API monitoring.
Process in Place to Ensure Backend Operations Know About Pinning:Ensure that the team is aware that any rotation of certificates that changes the public key will require new pins to be pushed out to apps beforehand to avoid any downtime. Attempt to use the same public key on renewals where possible, see Managing Dynamic Pinning.