SDK Overview

TrustPin provides native SDKs for all major mobile and desktop platforms, enabling you to implement OWASP-compliant certificate pinning with minimal integration effort.

Available SDKs

The Flutter package bundles the native SDKs (TrustPinKit 6.4.x on iOS/macOS, cloud.trustpin:kotlin-sdk 6.4.x on Android), so a single flutter pub get brings everything in. The React Native package wraps the same native SDKs for iOS and Android (no macOS).

iOS, macOS, watchOS, tvOS & visionOS

• Language: Swift
• Package Manager: Swift Package Manager, CocoaPods
• View iOS / macOS SDK Documentation

Android & JVM

• Language: Kotlin
• Package Manager: Maven Central
• View Android / Kotlin SDK Documentation

Flutter (Cross-Platform)

• Language: Dart
• Package Manager: pub.dev
• View Flutter SDK Documentation

React Native (iOS & Android)

• Language: JavaScript / TypeScript
• Package Manager: npm / yarn
• View React Native SDK Documentation

Quick Integration

All TrustPin SDKs follow a consistent 3-step integration pattern:

1. Install the SDK

Add TrustPin to your project using your platform’s package manager:

• iOS/macOS: Swift Package Manager or CocoaPods
• Android: Gradle with Maven Central
• Flutter: pub.dev package

2. Initialize TrustPin

Build a TrustPinConfiguration and pass it to setup() during app initialization. Each SDK can either load the configuration from a bundled file or accept it inline:

• iOS / macOS: TrustPinConfiguration.fromPlist() reads a bundled TrustPin-Info.plist
• Android / Kotlin: TrustPinConfiguration.fromAssets(context) reads src/main/assets/trustpin.json
• Flutter: TrustPin.shared.setupWithNativeBundle() defers to each platform’s native config file (TrustPin-Info.plist on iOS/macOS, trustpin.json on Android), so credentials never enter the Dart isolate

All three forms accept the same fields: organizationId / OrganizationId, projectId / ProjectId, publicKey / PublicKey, optional mode, and optional configurationURL.

Changed in 6.4.0: configurationURL must be HTTPS and point at a public host. Loopback and private addresses, such as localhost or the Android emulator’s 10.0.2.2, are rejected during setup and do not fall back to the default endpoint. A valid custom URL that cannot be fetched at runtime does fall back to the TrustPin CDN. Only the configuration source is affected, not which hosts your app pins. See Swift, Kotlin, Flutter, or React Native.

Every SDK also accepts an optional embedded configuration: a signed configuration bundled inside the app, used only on a first start where no online source and no previously validated configuration is available. It is a last-resort fallback for apps protected by RASP, never a replacement for the online configuration. See each platform’s guide for the option name and file placement:

setup() is non-blocking. It returns as soon as the configuration starts loading. To fail closed (block until a validated configuration is available before making pinned requests), await the new awaitConfiguration() gate after setup(). See each platform’s guide for the exact call.

3. Configure HTTP Client

Integrate TrustPin with your HTTP client:

• iOS / macOS: URLSession with TrustPin.makeURLSessionDelegate(), the Alamofire adapter (TrustPinKitAlamofire), or system-wide via TrustPinURLProtocol
• Android / JVM: OkHttp / Retrofit / Ktor via the trustpin-okhttp / trustpin-ktor adapters (.trustPin()), or manually with TrustPinSSLSocketFactory.create()
• Flutter: Dio with TrustPinDioInterceptor, or package:http via TrustPinHttpClient.create()

Key Features

All SDKs provide:

• ✅ OWASP-Compliant Pinning - Implements OWASP Mobile Security Testing Guide recommendations
• ✅ Zero-Downtime Updates - Update certificates remotely without app releases
• ✅ Automatic Validation - Certificate pinning happens automatically on all HTTPS requests
• ✅ Intelligent Caching - 10-minute configuration cache with automatic refresh
• ✅ Strict & Permissive Modes - Strict refuses unregistered domains. Permissive lets them through unpinned, with no validation events, and is for development only (release builds must use strict)
• ✅ Comprehensive Error Handling - Detailed error codes for debugging
• ✅ Embedded Configuration Fallback - Optional signed configuration bundled in the app, for a first launch with no reachable configuration source (RASP-protected apps only)

Validation Listener Payload

Every SDK offers an observe-only listener for definitive pin verdicts. What a failure event carries differs by platform:

Treat a presented certificate as untrusted input. See each platform’s guide for the exact API.

Platform-Specific Documentation

Choose your platform to view detailed integration guides, API references, and examples:

• iOS/Swift SDK - Native Swift implementation for Apple platforms
• Android/Kotlin SDK - Kotlin SDK for Android and JVM
• Flutter/Dart SDK - Cross-platform Dart package
• React Native SDK - JavaScript / TypeScript wrapper for iOS and Android

Need Help?

• 📧 Email: support@trustpin.cloud
• 📚 Documentation: docs.trustpin.cloud 
• 🎯 Dashboard: app.trustpin.cloud