Signatures

We currently have 3 ways you can migrate your signatures.

  • Signature V2 using SignatureAuthorization token

  • Signature V3 using SignatureAuthorization token

  • Signature V3 using your template app and override settings

Signature V2 and Signature V3 generation using SignatureAuthorization token has to be enabled by the Account Manager per client account before it can be used.

Signature V3 using your template app and override settings required no intervention from an Account Manager and can be used right away.

Signatures can be generated while creating a new app or for an already existing app.

It allows generating Adjust SDK Signature for Unity framework automatically when creating/updating the app using Adjust App Automation.

Signatures can be created with and without using _Template settings migrations.

Using SignatureAuthorization token

Signature V2

To generate Android signatures we need an Android signature SHA1 hash and a Signature Token authorization header.

If both hash and token are sent as part of POST /app request signature generation will be triggered in the background.

Format of the SignatureAuthorization token is:

"SignatureAuthorization: Token <Adjust Signature Token>"

For more information see Signature Token

A full example of POST /app request with signature data:

$ curl \
--header "AdjustAuthorization: Token <Adjust API Token>" \
--header "SignatureAuthorization: Token <Adjust Signature Token>" \
--header "Content-Type: application/json" \
--data '{
    "name":"Test App Name",
    "bundle_id":"test.bundle.app",
    "store_id":"test.bundle.app",
    "platform":"android",
    "android_signature_hash":
        "FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF",
    "channel_setup": { "facebook": {"app_id": "123456789"} }
}' \
-X POST https://settings.adjust.com/api/app

Signature V3

This is exactly the same as the section above regarding signature v2, but you will need to ask your Account Manager to turn on Signature V3 support for some or all of your apps.

Creating signatures without migrations

Please note: This only works for the Sigv2 or Sigv3 flow when using SignatureAuthorization header! If you want to use your template app, please see the section below to see how to only migrate signatures in your request!

It is possible to create signatures without running full settings migration by using separate endpoint POST /signature.

To create or update signature a request must have both Authorization tokens with required app_token and platform attributes in the body.

A full example of POST /signature request with signature data:

$ curl \
--header "AdjustAuthorization: Token <Adjust API Token>" \
--header "SignatureAuthorization: Token <Adjust Signature Token>" \
--header "Content-Type: application/json" \
--data '{
    "app_token":"qwerty",
    "platform": "ios"
}' \
-X POST https://settings.adjust.com/api/signature

For android apps it is required to include android_signature_hash value in the body or endpoint will return an error. Following is a short example, see here for more about Multiple signature hashes

"android_signature_hash": "AA:...:QQ"

If the app contains more than one platform (multiplatform app) it possible to generate both signatures in one request by setting the value of platform parameter to both:

"platform":"both",

Full request example could then look like this:

$ curl \
--header "AdjustAuthorization: Token <Adjust API Token>" \
--header "SignatureAuthorization: Token <Adjust Signature Token>" \
--header "Content-Type: application/json" \
--data '{
    "app_token":"qwerty",
    "platform": "both",
    "android_signature_hash": "AA:.....:AA,BB:....:CC"
}' \
-X POST https://settings.adjust.com/api/signature

Additionally it might be useful to enable Force SDK Signature flag in Adjust app to avoid manual manipulation in UI. To do this, it is necessary to include parameter force_sdk_signature with boolean true value.

"force_sdk_signature": true,

Multiple signature hashes

It is possible to send multiple signature hashes in a single request by delimiting them with a comma.

Let’s assume we have two hashes:

FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF:FF
AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA

By putting a comma between them we can send both under the same key in request JSON data as shown in the example. In the interest of brevity we will shorten them to FF:...:FF and AA:...:AA:

"android_signature_hash": "FF:...:FF,AA:...:AA",

Full request example could then look like this:

$ curl \
--header "AdjustAuthorization: Token <Adjust API Token>" \
--header "SignatureAuthorization: Token <Adjust Signature Token>" \
--header "Content-Type: application/json" \
--data '{
    "name":"Test App Name",
    "bundle_id":"test.bundle.app",
    "store_id":"test.bundle.app",
    "platform":"android",
    "android_signature_hash": "FF:...:FF,AA:...:AA"
}' \
-X POST https://settings.adjust.com/api/app

Fetching signatures

Cross-platform requests to GET /signature?bundle_id=<bundle_id> can be used to collect the SDK signature binaries using bundle_id.

Once available, Automation API will provide a single archive for both platforms to be unpacked into the Unity project.

Signature V3 signatures using your Template App and Override Settings

If you want to use this flow, do not use SignatureAuthorization header!

We will take any active secrets from your template app and add them to your target app. We will also apply the enforce signature validation setting from your template app.

We will ignore the field android_signature_hash if it is sent in the request. If you want to set different android signature hashes than what is in your template app, please see the exmaple below regarding override settings.

Please see this <https://help.adjust.com/en/article/sdk-signature#add-signatures-in-the-adjust-suite> guide on how to add add secrets to your template app and how to set up enforcing signature validation.

Example request for migrating all sections including signature

$ curl \
--header "AdjustAuthorization: Token <Adjust API Token>" \
--header "Content-Type: application/json" \
--data '{
    "name":"Test App Name",
    "bundle_id":"test.bundle.app",
    "store_id":"test.bundle.app",
    "platform":"android",
    "force_update":true
}' \
-X POST https://settings.adjust.com/api/app

Example request for migrating only signatures

$ curl \
--header "AdjustAuthorization: Token <Adjust API Token>" \
--header "Content-Type: application/json" \
--data '{
    "name":"Test App Name",
    "bundle_id":"test.bundle.app",
    "store_id":"test.bundle.app",
    "platform":"android",
    "sections": ["signature"],
    "force_update":true
}' \
-X POST https://settings.adjust.com/api/app

Using Overrides

Overriding android_signature_hash will only add new signature hashes. It will not delete existing ones in the target app or add androud signature hashes from the template app.

Overriding enforce_signature will take that value over the one in the template app.

Example request for migrating only signatures with override settings. Please note android_signature_hash is a list here.

$ curl \
--header "AdjustAuthorization: Token <Adjust API Token>" \
--header "Content-Type: application/json" \
--data '{
    "name":"Test App Name",
    "bundle_id":"test.bundle.app",
    "store_id":"test.bundle.app",
    "platform":"android",
    "sections": ["signature"],
    "force_update":true,
    "override_settings": {
    "signature": {
        "android_signature_hash": [
          "AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AB",
          "AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AC",
        ],
        "enforce_signature": true
    }
}
}' \
-X POST https://settings.adjust.com/api/app

We will also accept android_signature_hash as a comma seperated string.

$ curl \
--header "AdjustAuthorization: Token <Adjust API Token>" \
--header "Content-Type: application/json" \
--data '{
    "name":"Test App Name",
    "bundle_id":"test.bundle.app",
    "store_id":"test.bundle.app",
    "platform":"android",
    "sections": ["signature"],
    "force_update":true,
    "override_settings": {
    "signature": {
        "android_signature_hash": "AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AB,AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AA:AC",
        "enforce_signature": true
    }
}
}' \
-X POST https://settings.adjust.com/api/app