Mobile app protection
Detect and block invalid mobile traffic by connecting your MMP (AppsFlyer, Adjust, Branch, Kochava or Singular) and tracking clicks through Tapper.
Tapper's Mobile App Protection works alongside your MMP (Adjust, Branch, etc.) to detect invalid installs, sessions, and in-app events, without requiring an SDK in your app.
How it works
Tapper uses two data sources to identify invalid traffic:
1. Click Tracking
When a user clicks your ad, the click passes through Tapper before reaching your MMP tracking link. Tapper records click details like IP address, device ID, and campaign parameters for traffic analysis.
2. MMP Postbacks
When your MMP attributes an install or event, it sends a postback to Tapper. Tapper matches it against the original click data to detect invalid traffic patterns such as abnormal click-to-install times, device farms, geographic mismatches, and click flooding.
Ad click → Tapper tracker → MMP tracking link → App Store
↓
MMP attributes install → Tapper webhook → Invalid traffic detection
Setup overview
Have a protected entity
To create one, choose Add protected entity under Setup in the sidebar. Its public API key (pk) identifies all clicks and events for your app.
Connect your MMP
Open Setup > Mobile app > App protection and create an MMP integration with Add integration (for a first app, open Setup > Ad accounts, click Add ad account, then Add mobile app). Choose your MMP (AppsFlyer, Adjust, Branch, Kochava or Singular), optionally set a webhook secret, and copy the generated webhook URL.
Configure webhooks in your MMP
Paste the Tapper webhook URL into your MMP dashboard. Tapper starts receiving attribution postbacks immediately.
On Branch, enable Tapper under Ads Partners → Partner Management and paste in your Integration ID and Webhook Secret - see the Branch guide.
Set the webhook to send ALL events (REQUIRED)
Set the webhook scope to all events (all sources), not only attributed ones. Send all events, not only attributed below explains why and gives the exact setting for each MMP.
Set up click tracking (optional)
Replace your ad destination URL with a Tapper click tracker URL from Setup > Mobile app > Click tracking. This enables click-level traffic analysis and device ID capture before the MMP redirect.
Send all events, not only attributed
This is a required setup step, and it is the single most common reason a new integration looks broken.
Set the webhook scope to ALL events (all sources), not only attributed ones. With attributed-only, the integration receives ZERO events until campaigns attributed to Tapper exist - it will look broken while being filtered.
Diagnostic: if the integration shows no events but test webhooks succeed, check this setting first.
Each MMP names the setting differently:
| MMP | Where | Set it to |
|---|---|---|
| Branch | Ads Partners → Partner Management → Tapper → Postback Config | Tick the All Events checkbox on every Tapper postback and leave any condition or filter empty; left unchecked, a postback fires only for events already attributed to Tapper. |
| AppsFlyer | Configuration → Push API | Select both the organic and the non-organic message types (they are separate selections), plus every in-app event. (If you wire Tapper as a partner postback instead, set the media-source scope to All media sources, including organic, never This partner only.) |
| Kochava | App Configurations → Partner Configuration → Tapper → Install Postback Tools | Set Delivery Method to All, not Network Only - Network Only delivers only installs already attributed to Tapper, while All delivers regardless of attribution source. Repeat on every post-install event postback. |
| Singular | Postback configuration for the Tapper partner | Set the postback scope to all events from all sources, not only those attributed to a single partner. |
| Adjust | AppView → app → Server callbacks | Leave Add a condition empty - the global callback then fires for every trigger Adjust measures, organic included. A condition narrows it to one network. |
Supported MMPs
| MMP | Status |
|---|---|
| Adjust | ✅ Supported - full setup guide. |
| Branch | ✅ Supported - full setup guide. |
| AppsFlyer | ✅ Supported. Create the integration in Tapper, then point your Push API config at the webhook URL. |
| Kochava | ✅ Supported. Create the integration in Tapper, then point your partner postback at the webhook URL. |
| Singular | ✅ Supported. Create the integration in Tapper, then point your postback at the webhook URL. |
All five are selectable when you create an MMP integration. Whichever you use, complete Send all events, not only attributed - it applies to every one of them.
What Tapper analyzes
From MMP postbacks (attribution data):
- Network, campaign, ad group, and creative.
- Device IDs (IDFA, GAID).
- Activity type: install, session, or in-app event.
- Revenue and currency.
From the click tracker (click-time data):
- IP address and geolocation.
- User agent and device info.
- Campaign, ad group, and ad IDs from the tracking URL.
- Publisher and sub-publisher IDs.