Guardian SDK v0.5.2 fixes Android device identity and makes Android collection cheaper. It is additive and backward-compatible — a drop-in upgrade.

Guardian SDK v0.5.1 turns on device attestation for the native SDKs — Play Integrity on Android, App Attest on iOS — and lets each organization attest against its own Play Integrity project and choose how often devices re-attest. Configured in the dashboard; no code changes.

Guardian SDK v0.5.0 ships on every platform. On web it adds a durable install id so a returning browser is recognized as the same device; on all platforms the SDK now reports its own version with every transaction. Both are additive — a drop-in upgrade.

Guardian Web v0.4.0 brings the supplementary network-intelligence signal that the native SDKs already collect to the browser. collect() handles it on its own — there is no setup call — so upgrading the package is the whole integration.

Guardian Web v0.3.2 adds browser rendering signals to collect(). It is additive and backward-compatible — a drop-in upgrade.

Guardian SDK v0.4.2 adds a diagnostics object to verify() and collect() results so you can see what the SDK observed during a transaction. It is additive and backward-compatible — a drop-in upgrade.

Guardian SDK v0.4.0 makes the SDK production-only. The environment option and the Environment type are removed, so the backend URL and all internal device-intelligence checks are now fixed to production and cannot be pointed at a non-production target. This is a small breaking change from v0.3.x.

Guardian SDK v0.3.1 is a bug-fix release. There are no API changes - it is a drop-in upgrade from v0.3.0.

Guardian SDK v0.3.0 moves authentication off the client. Your backend now mints a short-lived token (a GeolocationJwt) and passes it to the client - the API key never ships in your app or web bundle. This is a breaking change from v0.2.x.

Guardian SDK v0.2.1 adds a new collect() API for server-to-server device verification.

New: collect() method​

The SDK now supports two verification paths:

• verify() (existing) — SDK calls Surt directly, returns a risk decision to your app
• collect() (new) — SDK collects and encrypts device data locally with zero network calls to Surt. Your backend sends the encrypted payload to POST /geolocation/transactions/evaluate and receives the full risk assessment

This is useful when your backend needs to make the risk decision, when you want to combine device risk with your own business logic, or when compliance requires all third-party calls to originate from your infrastructure.

Available on all platforms: React Native, iOS, and Android.

Read the full guide