Mobile SDK — Overview
| SDK | Platform | Status |
|---|---|---|
| Mobile Threat | Flutter · React Native | Shipping (0.1.0) |
| Native KYC | iOS · Android | Shipping |
The bridge / native split
The mobile SDKs have two layers, and the split is deliberate:
| Layer | What it does |
|---|---|
| Bridge package (Dart / TypeScript) | Orchestration — session context, call sequencing, typed results |
| Native module (Kotlin / Swift) | The actual threat and posture collectors |
⚠️
If the security measurement happened in the bridge layer, an attacker who compromised that layer would also defeat the measurement. So the collectors live natively; the bridge only carries the result.
The practical consequence: installing the bridge package is not enough — the native modules must be installed too. getPlatformDiagnostics() exists to confirm that.
Shared with the Web SDK
Mobile and web SDKs share the same platform contract:
- The decision is never made on the client — the SDK produces evidence, the server decides
- Not fail-open — a failed call does not silently return a pass
- Environments are separated by key — the SDK talks to whichever environment its key was issued for
- The same error envelope, the same
requestIdcorrelation
The difference: web SDKs rest on an Origin match in the browser. On mobile there is no Origin — device attestation and token bindings take its place.
Related
- Native KYC SDK — NFC, device integrity, liveness
- Mobile Threat SDK — transaction-time threat telemetry
- SDK Overview — the model shared by the web and mobile families
- Web KYC SDK — the browser counterpart