Operational boundaries
Privacy and trust
Apex separates user consent, contextual relevance and supply trust. A signal may inform server policy, but it never creates consent and it never proves more than its evidence supports.
Consent propagation
The SDK reads standard consent values written by the host application's CMP and serializes the applicable OpenRTB privacy fields. The SDK is not a CMP and does not manufacture or reinterpret user choice.
| Input | Use |
|---|---|
IABTCF_TCString | Propagated as the TCF consent string. |
IABTCF_gdprApplies | Controls the OpenRTB GDPR applicability signal. |
IABGPP_HDR_GppString | Propagated as the GPP string when supplied by the CMP. |
IABGPP_GppSID | Propagated as applicable GPP section identifiers. |
IABUSPrivacy_String | Respected by privacy-gated audience behavior. |
The publisher remains responsible for selecting a compliant CMP, establishing a lawful basis and configuring vendors and purposes correctly for its markets.
First-party audience cohorts
Cohorts are declarative rules evaluated against bounded signals the request already carries. The SDK does not embed a scripting engine, collect new sensors or send free-form user content to produce a cohort.
- Rules are data, not executable code.
- Matched segments use OpenRTB
user.data[].segment[]. - Purpose 4 consent gates cohort attachment.
- No consent means contextual request behavior.
- Remote rule changes do not require an application release.
Layered trust signals
The optional integrity path combines device verdicts with server verification. Emulator heuristics remain advisory. T2 requires a Play-recognized application and device integrity. T3 additionally requires strong integrity.
| Layer | Responsibility |
|---|---|
| Android SDK | Generate a per-install signing key, request Play Integrity evidence, sign eligible requests and fail safely. |
| Apex Ad Server | Verify app identity, certificate, freshness, nonce, body hash, sequence and trust lease. |
| Demand policy | Use trust tier alongside publisher authentication, supply-chain data and event history. |
| Publisher application | Ship through the registered Play identity and keep publisher configuration current. |
Before a valid lease exists, the SDK continues with unsigned T1 traffic. Server policy may restrict demand, serve house inventory or no-fill, but the SDK does not crash or block application content.
Request signing
Where supported, the SDK signs the HTTP method, exact path and query, timestamp, nonce, sequence and body hash. The server checks freshness and replay state. The trust lease secret and Play service-account credentials never enter the application.
ApexIntegrityExtension.install(PRODUCTION_CLOUD_PROJECT_NUMBER) ApexAds.init(this, productionConfig)
Production activation gate
Source code and unit tests are not sufficient evidence that production trust is active. Complete the following with a Google Play-installed release:
- Enable and link Play Integrity to the publisher release application.
- Configure the numeric Cloud project number in the integrity extension.
- Register the release package and Play app-signing SHA-256 certificate on the Ad Server.
- Keep service-account credentials and the shared server-side lease secret in deployment secret stores.
- Observe a live T2 or T3 lease from a Play-installed build.
- Verify successful signed auction and tracking requests.
- Reject replayed nonce, stale envelope, modified body, wrong package and wrong signing certificate cases.
- Confirm T1 fallback remains non-blocking.
Open the complete production runbook on GitHub.
OM SDK measurement status
The source repository includes the measurement integration boundary, but the IAB OM SDK binary is distributed after partner registration and is not bundled from Maven Central.
Do not describe Apex measurement as OM SDK certified until partner registration, the official binary, integration validation and certification evidence are complete.
Security reporting
Do not include publisher tokens, bidstream payloads, raw integrity tokens, user data or private keys in a public issue. Report reproducible non-sensitive defects through GitHub Issues and coordinate sensitive disclosure privately with the maintainer.