approov_service_flutter_httpclient 3.5.8

Approov enabled HttpClient

Approov Service for Flutter HttpClient

A wrapper for the iOS Approov SDK and Android Approov SDK to enable easy integration when using Flutter for making API calls you want to protect with Approov. In order to use this you will need a trial or paid Approov account.

See the Quickstart for a full integration example.

ADDING APPROOV SERVICE DEPENDENCY

The Approov integration is available via pub.dev. Add it to your pubspec.yaml:

dependencies:
  approov_service_flutter_httpclient: ^3.5.8

Then fetch it:

flutter pub get

This package depends on the closed-source Approov SDK for iOS and Android, which are pulled in automatically.

MANIFEST / PROJECT CHANGES

Android: no manual manifest changes are needed — the ACCESS_NETWORK_STATE and INTERNET permissions are bundled in the plugin's own manifest and merged into your app automatically.

iOS: both Swift Package Manager and CocoaPods are supported for the native iOS side, so no project changes are required either way:

• On Flutter 3.24+ with SPM enabled (flutter config --enable-swift-package-manager, the default from Flutter 3.44), the plugin resolves via SPM.
• On older Flutter versions, or with SPM disabled, the plugin falls back to its bundled .podspec via CocoaPods.

INITIALIZING APPROOV SERVICE

Initialize ApproovService once, early in your app's lifecycle (e.g. in main() before runApp):

import 'package:approov_service_flutter_httpclient/approov_service_flutter_httpclient.dart';

Future<void> initializeApproov() async {
  await ApproovService.initialize('<enter-your-config-string-here>');
}

initialize() throws ApproovException if the native SDK rejects the configuration. Decide deliberately what an initialization failure should mean for your app: see USAGE.md for the options, including the bypass-mode fallback that keeps the app usable at the cost of running unprotected.

The <enter-your-config-string-here> is a custom string that configures your Approov account access. This will have been provided in your Approov onboarding email.

On success the example logs the Approov device ID (getDeviceID()) and an app-generated session/correlation id so a given install can be correlated across your app logs, backend, and the Approov Live Metrics. If initialization fails, the example re-initializes with an empty config so the app keeps working — but those requests go out without Approov protection, so treat the backend as the enforcement point.

You can confirm bypass mode programmatically with await ApproovService.isApproovEnabled() (returns false when running unprotected, true when a real config is active) and await ApproovService.isInitialized() (true in both cases, once initialize() has been called at least once).

USING APPROOV SERVICE

Use ApproovHttpClient as a drop-in replacement for Dart's HttpClient:

import 'package:approov_service_flutter_httpclient/approov_service_flutter_httpclient.dart';

final client = ApproovHttpClient();
final request = await client.getUrl(Uri.parse('https://your.api.domain/endpoint'));
final response = await request.close();

Or ApproovClient if you use the package:http BaseClient interface:

import 'package:approov_service_flutter_httpclient/approov_service_flutter_httpclient.dart';

final client = ApproovClient();
final response = await client.get(Uri.parse('https://your.api.domain/endpoint'));

For API domains that are configured to be protected with an Approov token, this adds the Approov-Token header and pins the connection. This may also substitute header values when using secrets protection.

Approov errors are thrown as ApproovException (or its subtypes ApproovNetworkException / ApproovRejectionException).

See USAGE.md for mutator patterns, logging, and other customization options.

CHECKING IT WORKS

Initially you won't have set which API domains to protect, so requests won't be modified. It will have called Approov though and made contact with the Approov cloud service. You will see logging from Approov saying UNKNOWN_URL.

Your Approov onboarding email should contain a link allowing you to access Live Metrics Graphs. After you've run your app with Approov integration you should be able to see the results in the live metrics within a minute or so. At this stage you could even release your app to get details of your app population and the attributes of the devices they are running upon.

NEXT STEPS

To actually protect your APIs and/or secrets there are some further steps. Approov provides two different options for protection:

• API PROTECTION: use this if you control the backend API(s) being protected and can modify them to ensure that a valid Approov token is being passed by the app. An Approov Token is a short-lived cryptographically signed JWT proving the authenticity of the call.
• SECRETS PROTECTION: this allows app secrets, including API keys for 3rd party services, to be protected so that they no longer need to be included in the released app code. These secrets are only made available to valid apps at runtime.

Note that it is possible to use both approaches side-by-side in the same app.

See USAGE.md for day-to-day usage (mutators, message signing, secure strings, token binding) and REFERENCE.md for the full API reference.

---

Useful Links

• Approov iOS SDK
• Approov Android SDK
• Approov Website
• Quickstart Guide
• Changelog
• Reference Documentation
• Usage Guide