Mobile app protection
Detect invalid installs and in-app events with Tapper Block by connecting your MMP (Adjust, Branch, AppsFlyer or Kochava).
Tapper Block works alongside your mobile measurement partner (MMP) to detect invalid installs, sessions and in-app events. You add nothing to your app: no Tapper SDK is needed.
How Tapper Block reads mobile traffic
Tapper reads two sources.
MMP postbacks
When your MMP records an install or an event, it sends a postback to Tapper. Tapper checks each postback against the rule sets on the Mobile app page. A rule set has the tabs Click limits, Install time, Countries and Applies to.
Click tracking
Some networks give you a click URL to fill in: affiliate, incentive, OEM and DSP networks. For these, the click can pass through Tapper before it reaches your MMP's tracking link. Tapper records the click and the campaign parameters it carries.
Ad click → Tapper tracker → MMP tracking link → App Store
↓
MMP attributes install → Tapper webhook → Invalid traffic detection
What happens to an invalid install
On Adjust, Tapper rejects the invalid installs it finds in Adjust, with your Adjust API Token. On Branch, AppsFlyer and Kochava, Tapper detects and records invalid traffic and rejects nothing in the MMP.
While Monitoring-only mode is on for a rule set that judges an app, Tapper records what it detects for that app and never rejects an install. Each rule set has its own switch under Setup > Mobile app > Monitoring.
Where it lives in the app
Everything for your apps is under Setup > Mobile app in the sidebar. The row appears once your first app is connected through its MMP. If your workspace has more than one protected entity, pick the right one in the switcher under the workspace name first.
The Mobile app page lists these areas on the left:
- Apps: one entry per app, then Add app.
- Click tracking.
- Monitoring.
- Rule sets: every rule set, then New rule set.
Each app has its own tabs. Details holds its Name, Platforms, Tracking tool and app token. The second tab connects the app to Tapper Block through its MMP. Counting (Lift) appears when your workspace has Tapper Lift.
Setup overview
Connect your first app
Open Setup > Ad accounts and click Add ad account. On the Mobile app row, click Add mobile app.
In the Create MMP integration dialog, enter a Name, choose the MMP type, and enter the two credentials your MMP gives you. The dialog names each credential in your MMP's own words, for example Adjust App Token and Adjust API Token, or Branch Key and Branch Secret. Both are required.
Choose a webhook secret (optional)
Leave Webhook secret empty and Tapper generates one. A secret you choose needs at least 32 characters. Click Create.
Copy what Tapper gives you
The Integration created screen shows How to configure steps for your MMP, the Integration ID, the Webhook secret and the Webhook URL. The secret is shown only on this screen, so copy it before you click Done.
Configure your MMP
Follow the How to configure steps in your MMP's dashboard. On Adjust, paste the Webhook URL into a global server callback: see the Adjust guide. On Branch, enable Tapper as an ad partner and enter the Integration ID and Webhook Secret: see the Branch guide.
Send all events, not only attributed (required)
Set your MMP to send Tapper every event from every source, not only attributed ones. Send all events, not only attributed below gives the setting for each MMP.
Set up click tracking (optional)
For affiliate, incentive, OEM or DSP traffic, build a tracking link under Setup > Mobile app > Click tracking and use it as the network's click URL. Its destination is your MMP click URL. Tapper does not offer tracking links for Google Ads, Meta, TikTok or Snapchat, and tracking links are not for deep-link or re-engagement links.
Add another app
Open Setup > Mobile app and click Add app in the Apps list. Enter a Name, tick the Platforms (iOS, Android or both), choose the Tracking tool and enter the app token, then click Add app.
Then open the app's second tab, after Details, and turn on the switch at the top. The dialog that opens asks only for your MMP's API credential and an optional webhook secret, because the app already holds its name, tracking tool and app token. It ends on the same Integration created screen.
Send all events, not only attributed
This is a required setup step, and it is the most common reason a new integration looks broken.
Set your MMP to send all events from all sources, not only attributed ones. With attributed-only, Tapper receives zero events until campaigns attributed to Tapper exist, so the integration looks broken while it is only filtered.
If the integration shows no events but test webhooks succeed, check this setting first.
Each MMP names the setting differently:
| MMP | Where | Set it to |
|---|---|---|
| Branch | Ads Partners → Partner Management → Tapper. | Tick All Events on every Tapper postback and leave any condition or filter empty. |
| AppsFlyer | Your app → Configuration → Push API. | Tick both the organic and the non-organic message types (they are separate selections), plus every in-app event you want analyzed. If you set Tapper up as a partner postback instead, set the scope to All media sources, including organic, never This partner only. |
| Kochava | App Configurations → Partner Configuration → Tapper → Install Postback Tools. | Set Delivery Method to All, never Network Only, on the install postback and on every post-install event postback. |
| Adjust | AppView → All apps → your app → Server callbacks. | Leave Add a condition empty. The global callback then fires for every trigger Adjust measures, organic included. |
Supported MMPs
| MMP | Setup | Invalid installs |
|---|---|---|
| Adjust | Full setup guide. | Rejected in Adjust. |
| Branch | Full setup guide. | Detected and recorded. |
| AppsFlyer | Create the integration in Tapper, then add the Webhook URL in your app's Push API settings. | Detected and recorded. |
| Kochava | Create the integration in Tapper, then add Tapper as a partner and paste the Webhook URL in its Install Postback Tools. | Detected and recorded. |
| Singular | Singular appears in the MMP type list, but Tapper does not process Singular postbacks. | None. |
Whichever MMP you use, complete Send all events, not only attributed.
Check that events arrive
The app's second tab shows where the connection stands:
| Status | Meaning |
|---|---|
| Waiting for first install | Tapper has received nothing from your MMP for this app. |
| Receiving events | Postbacks arrive, and none was an install in the last 30 days. |
| Receiving installs | Installs arrive. Last install shows when your MMP last sent one. |
| Off | The app is not connected to Tapper Block through its MMP. |
| Paused | The switch is off. |
Last install reads No install in the last 30 days when there has been none in that time.
Pause, replace or disconnect
All of these are on the app's second tab and take effect at once.
- Turn the switch at the top off to pause. Tapper stops reading installs from this app and keeps its callback address.
- Next to Secret, click Replace to set a new webhook secret. Type one of at least 32 characters or click Generate. The old secret stops working at once, and the new one is shown once. Paste it into your MMP where the old one was. Tapper refuses your MMP's postbacks until you do.
- Next to the API credential, click Replace to enter a new one. The old one stops being used at once.
- Click Disconnect to remove the callback address and the saved secret. The app and Counting (Lift) stay.
To delete an app, open its Details tab and click Delete app in the Delete this app row. First click Disconnect on the app's second tab and, if it is on, switch off Counting (Lift). A paused connection still counts, so the button stays disabled until both are gone.
What Tapper analyzes
From MMP postbacks:
- Network, campaign, ad group and creative.
- Device IDs such as IDFA and GAID.
- Activity type: install, reinstall, session or in-app event.
- Revenue and currency.
- Click, store and install times.
From a click tracking link:
- IP address and user agent at click time.
- The fields the link carries:
campaign_id,ad_segment_id,ad_id,creative_id,publisher_id,sub_publisher_id,network,keyword,match_type,clid,idfaandgaid.