Skip to main content

Understand the Approov Flow

Approov works best when the first mental model is simple: your app proves itself to Approov, Approov issues a short-lived token, and your backend verifies that token before trusting the request.

Key Components​

The main components are:

  • Your app, with the Approov SDK integrated.
  • The Approov cloud service, which performs app and runtime integrity analysis.
  • Your backend API, which verifies the Approov token.
  • The Approov CLI, which you use to manage domains, certificates, users, and security settings.

The detailed architecture is covered in Approov Architecture.

App, Approov Cloud, and Backend API​

A typical request flow looks like this:

  1. The app prepares to call a protected API.
  2. The Approov SDK performs integrity checks and asks the Approov cloud for a token for that API domain.
  3. The Approov cloud returns a valid token if the app and environment pass policy checks.
  4. The app sends the token to your backend, normally in an Approov-Token header.
  5. The backend verifies the token signature and expiry before accepting the request.

The important design point is that your backend secret is never placed inside the app. Attackers cannot mint valid Approov tokens by reverse engineering the app.

What Success Looks Like​

After the first working integration:

  • Your app can fetch Approov tokens for configured API domains.
  • Your metrics show real app activity.
  • Your backend can distinguish valid, invalid, missing, or expired Approov tokens.
  • You can observe traffic safely before enabling blocking behavior.

Next, integrate the app so your mobile client can start requesting Approov tokens.