Mobile App Protection
Detect and block mobile ad fraud by connecting your MMP and tracking clicks through Tapper.
Tapper's Mobile App Protection works alongside your MMP (Adjust, Branch, etc.) to detect fraudulent installs, sessions, and in-app events — without requiring an SDK in your app.
How It Works
Tapper uses two data sources to identify fraud:
1. Click Tracking
When a user clicks your ad, the click passes through Tapper before reaching your MMP tracking link. Tapper records click details like IP address, device ID, and campaign parameters for fraud analysis.
2. MMP Postbacks
When your MMP attributes an install or event, it sends a postback to Tapper. Tapper matches it against the original click data to detect fraud patterns such as abnormal click-to-install times, device farms, geographic mismatches, and click flooding.
Ad click → Tapper tracker → MMP tracking link → App Store
↓
MMP attributes install → Tapper webhook → Fraud detection
Setup Overview
Create a Protection Script
In Tapper, create a Mobile App Protection script for your app. This gives you a public API key (pk) used to identify all clicks and events for that app.
Connect Your MMP
Create an MMP integration inside the protection script. Choose your MMP (AppsFlyer, Adjust, Branch, Kochava or Singular), set a webhook secret, and copy the generated webhook URL.
Configure Webhooks in Your MMP
Paste the Tapper webhook URL into your MMP dashboard. Tapper starts receiving attribution postbacks immediately.
On Branch, enable Tapper under Ads Partners → Partner Management and paste in your Integration ID and Webhook Secret — see the Branch guide.
Set the Webhook to Send ALL Events (REQUIRED)
Set the webhook scope to all events (all sources), not only attributed ones. With attributed-only, the integration receives zero events until campaigns attributed to Tapper exist — it will look broken while being merely filtered. See Send All Events, Not Only Attributed for the exact setting per MMP.
Set Up Click Tracking (Optional)
Replace your ad destination URL with Tapper's click tracker URL. This enables click-level fraud analysis and device ID capture before the MMP redirect.
Send All Events, Not Only Attributed
This is a required setup step, and it is the single most common reason a new integration looks broken.
Set the webhook scope to ALL events (all sources), not only attributed ones. With attributed-only, the integration receives ZERO events until campaigns attributed to Tapper exist — it will look broken while being merely filtered.
Diagnostic: if the integration shows no events but test webhooks succeed, check this setting first.
Most MMPs default a partner postback to "only send events this partner already won attribution for". That default is the trap: on day one Tapper has won attribution for nothing, so the filter matches nothing, and it will keep matching nothing until Tapper-attributed campaigns are running. Nothing is broken — everything is simply being filtered out.
Each MMP names the setting differently:
| MMP | Where | Set it to |
|---|---|---|
| Branch | Ads Partners → Partner Management → Tapper → Postback Config | Tick the All Events checkbox on every Tapper postback and leave any condition or filter empty; left unchecked, a postback fires only for events already attributed to Tapper. |
| AppsFlyer | Configuration → Push API | Select both the organic and the non-organic message types (they are separate selections), plus every in-app event. (If you wire Tapper as a partner postback instead, set the media-source scope to All media sources, including organic, never This partner only.) |
| Kochava | App Configurations → Partner Configuration → Tapper → Install Postback Tools | Set Delivery Method to All, not Network Only — Network Only delivers only installs already attributed to Tapper, while All delivers regardless of attribution source. Repeat on every post-install event postback. |
| Singular | Postback configuration for the Tapper partner | Set the postback scope to all events from all sources, not only those attributed to a single partner. |
| Adjust | AppView → app → Server callbacks | Leave Add a condition empty — the global callback then fires for every trigger Adjust measures, organic included. A condition narrows it to one network. |
Supported MMPs
| MMP | Status |
|---|---|
| Adjust | ✅ Supported — full setup guide. |
| Branch | ✅ Supported — full setup guide. |
| AppsFlyer | ✅ Supported. Create the integration in Tapper, then point your Push API config at the webhook URL. |
| Kochava | ✅ Supported. Create the integration in Tapper, then point your partner postback at the webhook URL. |
| Singular | ✅ Supported. Create the integration in Tapper, then point your postback at the webhook URL. |
All five are selectable when you create an MMP integration. Whichever you use, complete Send All Events, Not Only Attributed — it applies to every one of them.
What Tapper Analyzes
From MMP postbacks (attribution data):
- Network, campaign, ad group, and creative.
- Device IDs (IDFA, GAID).
- Activity type — install, session, or in-app event.
- Revenue and currency.
From the click tracker (click-time data):
- IP address and geolocation.
- User agent and device info.
- Campaign, ad group, and ad IDs from the tracking URL.
- Publisher and sub-publisher IDs.