Mobile SDKs

Native SDKs for Android and iOS, with Flutter and React Native snippets generated for you in the panel.

// Android
Roas.start(context, "YOUR_PUBLIC_KEY")
Roas.track("purchase_started", mapOf("plan" to "growth"))

// iOS
Roas.start(siteKey: "YOUR_PUBLIC_KEY")
Roas.track("purchase_started", ["plan": "growth"])

They run the same session model as the web SDK: 30 idle minutes, rolling at the visitor's local midnight. An app and a site compared on one dashboard are therefore measured the same way.

App beacons carry no Origin header for us to check, so they are HMAC-signed instead, with a third key that is never your API key.

That separation is the point: an extracted signing secret only buys the ability to forge beacons, which the public key already allowed. It can never post revenue. Rotate it and the problem is over.

Two campaigns can post identical day-one revenue while one buys customers and the other buys uninstalls. Mobile sessions are what tell them apart.

• Retention counts a return as a session on a later calendar day. Three opens in the hour after installing is still the install.
• Emulator and root detection flags a device rather than dropping it. Most emulator installs in real data are your own QA.
• Duplicate installs from one device are the device-farm tell, disclosed and never silently excluded.