Adjust’s SDK Signature library is designed to be a standalone plugin for the Adjust SDK. This means you don’t need to change any of your code or change how you use the Adjust SDK in your app. Once you install the plugin, all requests made by the Adjust SDK will continue to work as expected.
Before you begin
To integrate the Signature library into your Unity app, ensure the following:
- The Android API version in use is 21 or greater.
- The Adjust SDK version in use is 4.37.2 or greater. This requirement applies even when the Adjust SDK is used indirectly.
- If you use Proguard, you must use the exact same Proguard configuration for both the Signature library and the Adjust SDK.
- If you are interested in 16KB page size aligned Signature libraries, reach out to your Adjust representative or email support@adjust.com.
Migrating from Signature v1 or v2 library
If you previously used Signature v1 or Signature v2, you first need to remove the previous version before integrating the Signature library. To do this:
- If you previously integrated Signature v1, remove any code that calls to signature functions in your project.
- If you previously integrated Signature v2, remove the Signature v2 library from your project.
Updating the Signature Library
To update the Adjust Signature library, replace the existing Signature library with a new version and rerun your tests. You don’t need to make any immediate changes to your app logic or settings in Adjust as long as your certificates are configured and haven’t been altered. Remember to deactivate your secret IDs if they meet the following criteria:
- They’re no longer contributing to your install reporting.
- You’ve fully released a new version of your app (across all app platforms and stores).
Integrate the signature library (SDK v4 only)
Follow these steps to integrate the Signature library in your Unity project.
- Fetch the Signature library content from GitHub.
- Place the Android archive (
.aar
) file in theAssets/Adjust/Android
directory inside your Unity project. - Place the iOS static framework (
.a
) in theAssets/Adjust/iOS
directory inside your Unity project.
That’s it! The Signature library is now integrated into your project. Follow the steps in the next section to configure your digital certificates.
Set up your certificates in the Adjust suite
Once you integrate the Signature library into your app, all requests sent by the Adjust SDK to Adjust are signed. The Adjust SDK will also transmit relevant information to Adjust’s servers, including the fingerprint of your signing certificate.
A certificate fingerprint is a cryptographic hash of the public information held within a certificate. It can be used to verify the authenticity of an app.
The Signature library can’t verify the authenticity of your certificate fingerprints. The fingerprints need to be added to an allowlist in the Adjust Suite in order for requests containing them to be accepted by Adjust as authentic. To do this, you need to retrieve the certificate fingerprints and send them to Adjust.
From a keystore
If you use your own keystore, or if Android Studio generated a keystore for you, you can retrieve the certificate fingerprint by following these steps:
-
Find the keystore file (
.jks
) you used to sign the release version of your app. The keystore must be the one you used to sign the release version sent to the Google Play Store. If the keystore is different, your SDK requests will be rejected. -
Run the following command to list your keys. Replace the parts in angle brackets with your information.
This command prompts you for your keystore password. This is the password you defined when you generated the keystore.
The final output looks like this:
-
Save the SHA-1 fingerprint to add to your allowlist in the Adjust Suite.
From Google Play Internal App Sharing
If you use Google Play Internal App Sharing, you need to send both your organization’s SHA-1 certificate fingerprint and your Internal test certificate fingerprint to Adjust for allowlisting.
To extract the fingerprints:
- Navigate to the Google Play Console and log in.
- Select your app.
- Select Release Management —> App Releases —> Manage internal app sharing > App certificates.
- Save the SHA-1 certificate fingerprint for both the Internal test certificate and your organization’s keystore to add to your allowlist in the Adjust Suite.
From Google Play App Signing
If you use Google Play App Signing, you need to send both your organization’s SHA-1 certificate fingerprint and your Internal test certificate fingerprint to Adjust for allowlisting.
To extract the fingerprints:
- Navigate to the Google Play Console and log in.
- Select your app.
- Select Release Management > App Signing.
- Save the SHA-1 certificate fingerprint for both the App signing certificate and Upload certificate to send to Adjust.
From Huawei AppGallery App Signing
If you use Huawei AppGallery App Signing, you need to send both your organization’s SHA-1 certificate fingerprint and your Internal test certificate fingerprint to Adjust for allowlisting.
To extract the fingerprints:
- Navigate to the App Signing page in AppGallery Connect and download the App signing certificate (
certificate.pem
).
-
Once you’ve downloaded the certificate, run the following command to output the SHA-1 fingerprint of the certificate.
The output looks like this:
-
Save the fingerprint to add to your allowlist in the Adjust Suite..
Add your digital certificate fingerprints to Adjust’s allowlist
Once you’ve obtained your certificate fingerprints, do the following to add them to your allowlist:
- Select your app in AppView to open the app details screen.
- Select the Protection tab.
- Select the Edit button on the Suspicious installs section.
- Under the Android fingerprinting section, select New fingerprint.
- Paste the SHA-1 fingerprint into the text box that appears.
- Select Add.
That’s it! Your fingerprint is now allowlisted for your app.
Test your app
You can verify you have integrated the Signature library into your app using the Adjust Testing Console.
To test your Signature library integration:
-
Fully delete your app from the test device to ensure the install information is sent.
-
Forget the device using the Testing Console to clear out all information relating to the device. You can also use the forget_device endpoint by passing your app token and the advertising ID you obtained from the Adjust Insights app (available on iOS and Android). You can use any of the following advertising IDs:
adid
,android_id
,gps_adid
,idfa
,idfv
,imei
,oaid
.The call looks like this:
-
Once you’ve cleared the device from the Testing Console, install the app on your test device and launch it to send install information to Adjust.
-
Input the test device’s advertising ID into the Testing Console to fetch the install event information. Check the following:
- The
SignatureVerificationResult
field should show a value ofValid Signature
- The
SignatureVersion
field should show a value of3
- The
If these fields are present and contain the correct information, you have successfully integrated the Signature library. If the fields display any other values, review the integration steps again or contact support@adjust.com for further assistance.
That’s it! You’ve successfully integrated the Signature library into your app. Once two attribution windows have passed, you can enforce SDK signature validation to make sure that only signed requests are accepted by Adjust.
Troubleshooting
Unknown CPU Architecture in AdjustSigSdk.a
In Unity Editor 2018 and later, you may receive an error message containing Unknown CPU Architecture. This error message is shown when the Unity Editor tries to apply the iOS static framework (.a
) to non-iOS platforms. To fix the issue, select the AdjustSigSdk.a
file and deselect all platforms except iOS in the Import Settings menu.