Skip to main content

Integrate the Backend

Backend integration is where Approov starts protecting the API, not just the app. The backend checks that each protected request includes a valid Approov token.

Choose the Backend Integration Option​

If you control the backend API, use Approov tokens. Your backend verifies the token signature, expiry, and claims before accepting the request.

If you cannot modify the backend, use secure strings to protect API keys or other secrets that would otherwise be shipped inside the app.

The deeper architecture discussion is in Backend Integration Options.

Verify Approov Tokens​

Approov tokens are JWTs. Most backend stacks already have JWT libraries that can verify the token signature and expiry.

To check tokens signed with the default account secret, export the account secret key with:

approov secret -get base64

Treat this secret like production infrastructure secret material. Do not commit it to source control or expose it in client-side code.

The detailed backend reference is Foundation.

Use Secure Strings When Backend Changes Are Not Possible​

Secure strings let Approov deliver secrets to apps only after attestation succeeds. This can help when the app must call a third-party API and you cannot add Approov token validation to the backend.

Secure strings are covered in Secure Strings.

Expected Outcome​

At the end of this step:

  • Your backend can identify valid, invalid, missing, and expired Approov tokens.
  • Your app can still operate while you monitor invalid-token events.
  • You have a safe path to enable blocking once traffic looks healthy.

Next, test and monitor the complete flow before enabling blocking.