Mobile app protection
Detect invalid installs and in-app events with Tapper Block by connecting your MMP (Adjust, Branch, AppsFlyer or Kochava).
Tapper Block works alongside your mobile measurement partner (MMP) to detect invalid installs, sessions and in-app events. You add nothing to your app: no Tapper SDK is needed.
How Tapper Block reads mobile traffic
Tapper reads two sources.
MMP postbacks
When your MMP records an install or an event, it sends a postback to Tapper. Tapper checks each postback against the rule sets on the Mobile app page. A rule set has the tabs Click limits, Install time, Countries and Applies to.
Click tracking
Some networks give you a click URL to fill in: affiliate, incentive, OEM and DSP networks. For these, the click can pass through Tapper before it reaches your MMP's tracking link. Tapper records the click and the campaign parameters it carries.
Ad click → Tapper tracker → MMP tracking link → App Store
↓
MMP attributes install → Tapper webhook → Invalid traffic detection
What happens to an invalid install
Tapper detects and records every invalid install and event your MMP sends, on Adjust, Branch, AppsFlyer and Kochava alike. It rejects nothing in your MMP, so your MMP's own data stays as it recorded it.
Where it lives in the app
Everything for your apps is under Setup > Mobile app in the sidebar. With no app yet, the page opens on the form that adds one. If your workspace has more than one protected entity, pick the right one in the switcher under the workspace name first.
The Mobile app page lists these areas on the left:
- Apps: one entry per app, then Add app.
- Click tracking.
The rules that judge your apps' installs and events are on their own page, Setup > Rule sets, under Mobile apps.
Each app's page is one column of cards. Details holds its Name, Platforms, Tracking tool and app token. Access holds every key of the app: your tracking tool's API token, and once Block is switched on, the callback address and the secret. Under Access, the Block card holds the one switch that connects the app to Tapper Block. Counting (Lift) appears for an Adjust app when your workspace has Tapper Lift.
Setup overview
Open Setup > Mobile app and click Add app (with no app yet, the form is already open). Enter a Name, tick the Platforms (iOS, Android or both), choose the Tracking tool and enter the app token, then click Add app. The form names the token in your tool's own words, for example Adjust App Token or Branch Key. On a new workspace, Add mobile app on the Mobile app row of the connect step opens the same form.
On Kochava, add the Kochava API Key on the app's Access card before you switch on Block: Tapper uses it once, to register the callback address in Kochava. Block needs no key from Adjust, Branch or AppsFlyer.
On the app's page, turn on the switch on the Block card, under Access. The dialog asks for nothing: click Switch on. It shows the steps for your tool, the Secret, the Callback address and, for Branch, the Integration ID. The secret is shown only in this dialog, so copy it now; afterwards the Access card keeps a preview.
Follow the steps in your tool's dashboard. On Adjust, paste the callback address into a global server callback: see the Adjust guide. On Branch, enable Tapper as an ad partner and enter the Integration ID and the secret: see the Branch guide.
Set your tool to send Tapper every event from every source, not only attributed ones. Send all events, not only attributed below gives the setting for each tool.
For affiliate, incentive, OEM or DSP traffic, build a tracking link under Setup > Mobile app > Click tracking and use it as the network's click URL. Its destination is your tracking tool's click URL. Tapper does not offer tracking links for Google Ads, Meta, TikTok or Snapchat, and tracking links are not for deep-link or re-engagement links.
Send all events, not only attributed
This is a required setup step, and it is the most common reason a new integration looks broken.
Set your MMP to send all events from all sources, not only attributed ones. With attributed-only, Tapper receives zero events until campaigns attributed to Tapper exist, so the integration looks broken while it is only filtered.
If the integration shows no events but test webhooks succeed, check this setting first.
Each MMP names the setting differently:
| MMP | Where | Set it to |
|---|---|---|
| Branch | Ads Partners → Partner Management → Tapper. | Tick All Events on every Tapper postback and leave any condition or filter empty. |
| AppsFlyer | Your app → Configuration → Push API. | Tick both the organic and the non-organic message types (they are separate selections), plus every in-app event you want analyzed. If you set Tapper up as a partner postback instead, set the scope to All media sources, including organic, never This partner only. |
| Kochava | App Configurations → Partner Configuration → Tapper → Install Postback Tools. | Set Delivery Method to All, never Network Only, on the install postback and on every post-install event postback. |
| Adjust | AppView → All apps → your app → Server callbacks. | Leave Add a condition empty. The global callback then fires for every trigger Adjust measures, organic included. |
Supported MMPs
| MMP | Setup | Invalid installs |
|---|---|---|
| Adjust | Full setup guide. | Detected and recorded. |
| Branch | Full setup guide. | Detected and recorded. |
| AppsFlyer | Switch on Block for the app in Tapper, then add the callback address in your app's Push API settings. | Detected and recorded. |
| Kochava | Switch on Block for the app in Tapper, then add Tapper as a partner and paste the callback address in its Install Postback Tools. | Detected and recorded. |
| Singular | Singular appears in the Tracking tool list, but Tapper does not process Singular postbacks. | None. |
Whichever MMP you use, complete Send all events, not only attributed.
Check that events arrive
The app's Block card shows where the connection stands:
| Status | Meaning |
|---|---|
| Waiting for first install | Tapper has received nothing from your tool for this app. |
| Receiving events | Callbacks arrive, and none was an install in the last 30 days. |
| Receiving installs | Installs arrive. Last install shows when your tool last sent one. |
| Off | Block is not switched on for this app. |
| Paused | The switch is off. |
Last install reads No install in the last 30 days when there has been none in that time.
Pause, replace or disconnect
These take effect at once.
- On the Block card, turn the switch off to pause. Tapper stops reading installs from this app and keeps its callback address.
- On the Access card, next to Secret, click Replace to set a new secret. Type one of at least 32 characters or click Generate. The old secret stops working at once, and the new one is shown once. Paste it into your tool where the old one was. Tapper refuses your tool's callbacks until you do.
- On the Access card, next to the API token, click Replace to enter a new one. The old one stops being used at once.
- On the Block card, click Disconnect to remove the callback address and the saved secret. The app and Counting (Lift) stay.
To delete an app, go to its Details card and click Delete app in the Delete this app row. First click Disconnect on the Block card and, if it is on, on the Counting (Lift) card: a paused connection still counts, so the button stays disabled until both are gone.
What Tapper analyzes
From MMP postbacks:
- Network, campaign, ad group and creative.
- Device IDs such as IDFA and GAID.
- Activity type: install, reinstall, session or in-app event.
- Revenue and currency.
- Click, store and install times.
From a click tracking link:
- IP address and user agent at click time.
- The fields the link carries:
campaign_id,ad_segment_id,ad_id,creative_id,publisher_id,sub_publisher_id,network,keyword,match_type,clid,idfaandgaid.