Going to production

What the current release (0.19.0) offers on each platform, and what to check before your app ships with the SDK.

What is ready on each platform

	Web	Flutter	Android	iOS	React Native
Install the current release	Yes, from DEA's release URL	Yes, from DEA's release URL	Not available yet	Not available yet	Not available yet
Read the classification	Yes	Yes	Yes	Yes	Yes
Pass an appKey	Yes	Yes	Yes	Yes	No
Attest	Yes, a browser key	Android 6.0+ and iOS 14+	Android 6.0+	iOS 14+	No: needs an appKey
Ads	Yes, after attest()	Proof calls, no touch check	Proof calls, no touch check	Proof calls, no touch check	No
Model updates over the air	On by default	When you pass modelDirectory	On by default	On by default	On by default
Consent required by default	No: turn it on with requireConsent	Yes	Yes	Yes	Yes

The Android, iOS and React Native guides describe the SDK's current source. No published Android or iOS package contains it yet.

The model behind the classification

Each package embeds a model, and the SDK replaces it with a newer one when DEA publishes one and updates are on. The classification names the model it came from in modelVersion; the thresholds it compares the score with come from that model (see How scoring works).

Treat the classification as one signal among the ones you already have. A careful rollout reads it and logs it next to your existing checks first, and starts acting on it once you have seen how it behaves on your traffic. Always give undetermined a fallback path, and treat insufficient as too early, not as bot.

Attest

Attest registers the device's signing key with DEA, under the app your appKey names. It needs:

• an appKey (see Accounts and keys),
• on Android, Google Play Integrity (the Standard API). Play issues a token only for a build it recognizes, installed from Google Play or signed with a key registered in your Play Console entry, and only for the Google Cloud project your app is linked to in Play Console. Unless you set playIntegrityProject, the SDK asks for a token for DEA's own project, whose credentials DEA's service decodes it with: which project your app links to is agreed with DEA when it registers your app,
• on iOS, the App Attest capability, on iOS 14 or later,
• on the web, a secure origin. Browsers offer no platform attestation, so the key is registered without a token from Google or Apple.

Each platform's Attest page lists what the SDK sends and what each result means.

Browser support

The Web SDK needs Chrome or Edge 96, Firefox 95, or Safari 15.4 (macOS and iOS) or later, on a page served over HTTPS or from localhost. These are the first versions with every browser feature the SDK uses: on a plain-HTTP page or an older browser, init throws (see the Web Troubleshooting).

If your pages send a Content Security Policy, it must allow 'wasm-unsafe-eval' in script-src and the SDK's requests in connect-src: the Web guide lists each directive.

Offline and network failures

Capture and the classification never use the network: an app that is offline scores as usual.

Request	When it fails
Model update check	The model in use keeps scoring. The next check runs at the next start (on Android, iOS and Flutter also when the app returns to the foreground a day later)
Attestation, Android, iOS and Flutter	Renewal is retried after 30 seconds, then 1, 2 and 5 minutes, then every 15 minutes. When DEA or the platform refuses a registration that used a Play Integrity or App Attest token, the SDK stops trying for an hour, doubling with each refusal in a row up to 7 days, across app launches
Attestation, Web	Nothing is retried on its own: the next attest() call tries again
Proofs	Retried only when DEA cannot be reached or answers with a server error: up to 5 sends, waiting 2 seconds and doubling up to 30, and never after the proof's 90-second lifetime. A refusal ends it at once. Proofs are not stored: one not delivered in time is lost

On Android and iOS, the proof and attestation calls block the calling thread through these waits.

Battery

Platform	What runs
Android, iOS, Flutter	The accelerometer and gyroscope run at motionRate readings a second (50 by default) from init until dispose(), including while capture is paused, before consent and in the background. While the user is idle the SDK keeps one reading every 3 seconds, but the sensors keep their rate. setMotion(false) stops them, and the classification is then computed without motion, which the mobile model reads
React Native	As Android and iOS. The iOS side ignores the motion options
Web on phones and tablets	The browser's motion events, at the browser's own rate, while the page is open
Web on desktops	A 50 ms timer while the page is visible and capture is running

A lower motionRate reduces the cost. What 0 does differs: the Web and Android turn motion off (on Android, setMotion(true) cannot turn it back on), iOS and Flutter raise anything below 25 to 25, and React Native on Android treats 0 as 50.

The SDK's own network use is one model check per start, and, once your app has called attest() on Android, iOS or Flutter, a renewal about once an hour while the app runs.

Threading

Platform	Rules
Web	Everything runs on the page's main thread. getClassification() is synchronous and cheap: read it per decision, not per frame. Calls that use the network return a Promise
Android	Call init and the capture methods (pause, resume, reset, setConsent, captureEvent) on the main thread. attest(), renewAttestation(), storedAttestation(), checkForModel(), record(), sendProof() and getProof() block: call them off the main thread. getClassification() is safe from any thread. Model listeners run on an SDK thread, attestation events on the thread that made the decision, onLog on the thread that logs, and the consent dialog's callback on the main thread
iOS	The same split: init and the capture methods on the main thread, the attestation and proof calls off it, getClassification() from any thread. modelChanges and checkForModel's completion run off the main thread, onLog on the thread that logs. Do not call back into the SDK from onLog
Flutter	Everything runs on the UI isolate. Calls that use the network return a Future; getClassification() is synchronous. Use the SDK from the main isolate only
React Native	Every call returns a Promise. The native SDKs run on the main thread, and network calls on a background queue

Android build

The Android SDK is built with minSdk 21 (Attest needs API 23), compileSdk 35, Java 17, Kotlin 2.2.20 and Android Gradle Plugin 9.4.0, and depends on Google's Play Integrity library 1.4.0. An app compiled with Kotlin 2.2 or later reads it; Kotlin's own compatibility policy makes Kotlin 2.1 a best effort, not a guarantee.

Versions and compatibility

• One version per release. A platform's packages share one version number: install the SDK and its companion package from the same release. On the Web the SDK brings its companion with it; on Flutter, download both zips at the same version: a mismatched pair makes init report CoreMismatch and score nothing.
• Models. The SDK downloads a model only when its scoring engine can read it; any other model is ignored, and the current one keeps scoring.
• Releases. Each release lists its files at https://sdk.dep-protocol.com/<version>/manifest.json, and https://sdk.dep-protocol.com/registry/latest.json names the latest one, 0.19.0 as these guides were built. DEA publishes no release notes.

Before you release

• [ ] Each app is registered with DEA, and each build passes the appId and appKey of the app it is — Accounts and keys
• [ ] The install line names the release you tested with
• [ ] Consent: the user is asked before capture where your policy requires it — the platform's User Consent page
• [ ] Capture is paused on screens that show sensitive content — the platform's Sensitive Screens page
• [ ] The session is reset on logout and account switch — the platform's Sessions page
• [ ] The classification is read at a decision point, with a fallback for bot, undetermined and insufficient, and a ThresholdMissing error is caught — the platform's Human Scoring page
• [ ] On Android and iOS, the attestation and proof calls run off the main thread — Threading
• [ ] On Android, your app is linked in Play Console to the Google Cloud project agreed with DEA — Attest
• [ ] On the Web, the browsers you support and your Content Security Policy match Browser support
• [ ] Debug output is off in release builds
• [ ] Your privacy disclosures cover what the SDK captures, stores and sends — Privacy and network
• [ ] The platform guide's own "Before you release" checklist is done