AbuseGraph
← Back to guides

Android SDK (Kotlin)

Protect signup and login in Android apps with the AbuseGraph Kotlin SDK — session → check, fail-open.

Install the Android SDK

// settings.gradle.kts — include packages/sdk-android/abusegraph
// app/build.gradle.kts:
//   implementation(project(":abusegraph"))
// Requires OkHttp 4+

val client = AbuseGraphClient(
  apiKey = System.getenv("ABUSEGRAPH_SECRET_KEY") ?: "sk_test_…",
  site = "yourdomain.com",
)

Proxy sk_ keys through your backend. Play Integrity goes in DeviceCollect.attestation.

Keys

Use sk_test_… while integrating. Production sk_live_… belongs on your backend — never in a public APK. Pass the DNS-verified site as site / x-abusegraph-site.

Flow

  1. Collect device metadata (DeviceCollectFactory.current).
  2. sessionThenCheck → session then check.
  3. Enforce verdict in your app. On failOpen, allow the user.

kotlin

val client = AbuseGraphClient(
  apiKey = System.getenv("ABUSEGRAPH_SECRET_KEY") ?: "sk_test_…",
  site = "yourdomain.com",
)

val result = client.sessionThenCheck(
  email = email,
  event = AbuseGraphEvent.SIGNUP,
)

when {
  result.failOpen -> { /* allow */ }
  result.verdict == AbuseGraphVerdict.BLOCK -> { /* reject */ }
  else -> { /* allow / step-up */ }
}

Play Integrity (optional)

kotlin

val device = DeviceCollectFactory.current(attestation = integrityToken)
val result = client.sessionThenCheck(
  email = email,
  event = AbuseGraphEvent.SIGNUP,
  device = device,
)

Package

Source: packages/sdk-android/abusegraph (OkHttp). See also iOS and React Native.