Fraud Detection:Integrate the Fraud Detection SDK for Android

Prerequisites

Before you begin, ensure that you have:

• An Android app targeting Android 4.0.3 or later, with minSdkVersion set to 15 or later

• The latest SDK version published on Alibaba Cloud's official website (required for privacy compliance)

• Read the Fraud Detection SDK Privacy Policy and the relevant rules for processing personal information

Permissions

The SDK requires one mandatory permission and benefits from several optional ones. Grant optional permissions before SDK initialization to improve detection accuracy.

Download and configure the SDK

1. Download the Android SDK package and decompress it. The package is a standard .aar (Android Archive) file.

2. Copy the .aar file to the libs directory of your project.

3. Add the following dependencies to your app's build.gradle file:

   // Device Fraud Detection SDK
   implementation files('libs/Android-AliyunDevice-<version>.aar')
   
   // Required network library dependencies
   implementation 'com.squareup.okhttp3:okhttp:3.11.0'
   implementation 'com.squareup.okio:okio:1.14.0'

   Important

   Add the network library dependencies. Without them, the SDK cannot connect to the internet.

Collect data

Call initWithOptions as early as possible in your app lifecycle — ideally in Application.onCreate() — after obtaining user privacy consent. The SDK uses the collected device signals to generate a device token.

Call this function at risk-sensitive entry points such as account registration, login, and promotional event access, where device-level fraud signals are most relevant.

public interface SecurityInitListener {
    // code: status code indicating whether data collection succeeded
    void onInitFinish(int code);
}

public void initWithOptions(
    Context ctx,
    String appKey,
    Map<String, String> options,
    SecurityInitListener securityInitListener
);

Get the device token

After calling initWithOptions, wait at least 2 seconds, then call getDevicetoken from a background thread to retrieve the device token. Send the token to your application server, which uses it to query device risk information from the Device Fraud Detection API.

public class Securitytoken {
    // Status code indicating whether the token was retrieved successfully
    public int code;

    // Token string used to query risk results on the server side
    public String token;
}

public Securitytoken getDevicetoken();

Sample code

The following example shows a complete integration: initializing data collection in Application.onCreate() and retrieving the device token in a background thread when a risk-sensitive event occurs, such as user registration or a promotional activity.

Java

public class CustomApplication extends Application {
    // Get your appKey from the Device APP management tab in the Fraud Detection console
    private static final String ALIYUN_APPKEY = "xxxx";

    @Override
    public void onCreate() {
        super.onCreate();

        // Exclude non-resettable device identifiers to meet privacy requirements.
        // Separate multiple DataType values with |.
        Map<String, String> options = new HashMap<>();
        options.put("DataType", "NO_IDENTIFY_DEVICE_DATA");

        // Call initWithOptions as early as possible after privacy consent is obtained.
        SecurityDevice.getInstance().initWithOptions(this, ALIYUN_APPKEY, options, null);
    }
}

After the app initializes, retrieve the device token in a background thread when a risk-sensitive event occurs. Wait at least 2 seconds after initWithOptions before calling getDevicetoken.

new Thread() {
    @Override
    public void run() {
        Securitytoken st = SecurityDevice.getInstance().getDevicetoken();
        if (st != null) {
            if (SecurityCode.SC_SUCCESS == st.code) {
                Log.d("AliyunDevice", "token: " + st.token);

                // Send the token to your application server.
                // Your server uses this token to call the Device Fraud Detection API.
                // sendToAppServer(st.token);
            } else {
                Log.e("AliyunDevice", "getDevicetoken error, code: " + st.code);
            }
        } else {
            Log.e("AliyunDevice", "getDevicetoken returned null.");
        }
    }
}.start();

Kotlin

class CustomApplication : Application() {
    // Get your appKey from the Device APP management tab in the Fraud Detection console
    private val ALIYUN_APPKEY = "xxxx"

    override fun onCreate() {
        super.onCreate()

        // Exclude non-resettable device identifiers to meet privacy requirements.
        val options = HashMap<String, String>()
        options["DataType"] = "NO_IDENTIFY_DEVICE_DATA"

        // Call initWithOptions as early as possible after privacy consent is obtained.
        SecurityDevice.getInstance().initWithOptions(this, ALIYUN_APPKEY, options, null)
    }
}

Retrieve the device token in a background thread using a coroutine dispatcher. Wait at least 2 seconds after initWithOptions before calling getDevicetoken.

// Use Dispatchers.IO to avoid blocking the main thread (prevents ANR errors)
CoroutineScope(Dispatchers.IO).launch {
    val st = SecurityDevice.getInstance().getDevicetoken()
    if (st != null) {
        if (SecurityCode.SC_SUCCESS == st.code) {
            Log.d("AliyunDevice", "token: ${st.token}")

            // Send the token to your application server.
            // Your server uses this token to call the Device Fraud Detection API.
            // sendToAppServer(st.token)
        } else {
            Log.e("AliyunDevice", "getDevicetoken error, code: ${st.code}")
        }
    } else {
        Log.e("AliyunDevice", "getDevicetoken returned null.")
    }
}

Obfuscation

Add the following rules to your ProGuard configuration to prevent the SDK from being obfuscated:

-keep class net.security.device.api.** {*;}
-dontwarn net.security.device.api.**

Status codes

Call the Device Fraud Detection API

After your server receives the device token, use it along with other event parameters to call the Device Fraud Detection API and retrieve the device risk result.

For the full list of request and response parameters, see Service event parameters and response parameters for Device Fraud Detection.

FAQ

Which CPU architectures does the SDK support?

The SDK supports ARM, ARMv7, and ARM64 architectures.

How large is the SDK package?

A mono-architecture Shared Object (SO) file is approximately 1.8 MB. The package is large because it includes obfuscation, dilation, and cryptographic operations to prevent reverse engineering and secure data in transit.

How long is a device token valid? Can I reuse it?

A device token is valid for 7 days. You can use the same token for multiple server-side API calls within that period.