> For the complete documentation index, see [llms.txt](https://waap.docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://waap.docs.link11.com/mobile-sdk-v2.3.0/ios.md).

# iOS

## Introduction <a href="#how-the-sdk-works" id="how-the-sdk-works"></a>

The SDK supports both programmatic integration, and no-code *auto-sign* approach (if your app uses the **NSURLRequest** networking API, or any of the wrappers, like [Alamofire](https://github.com/Alamofire/Alamofire), [Moya](https://github.com/Moya/Moya), [FSNetworking](https://github.com/foursquare/FSNetworking), or [SwiftHTTP](https://github.com/daltoniam/SwiftHTTP)). The SDK does not currently support tvOS or watchOS.

{% hint style="info" %}
These instructions assume that you have already read the [Developer Guide](/mobile-sdk-v2.3.0/developer-guide-sdk-v2.3.0.md). If you have not yet done so, please do so before continuing below.
{% endhint %}

This SDK comes with examples: two full Xcode projects are enclosed, one was written in Swift, another in Objective-C. You can play with these examples to understand how SDK integration works.

In the recent versions of Xcode, **Enable Bitcode** option is ON by default. This is [not required for iOS apps](https://stackoverflow.com/q/34201301). The bitcode option is not fully supported in Link11 WAAP's Mobile SDK. To use the Mobile SDK in your application, you must disable bitcode when you export the application for App Store distribution.

## Installation <a href="#installation" id="installation"></a>

### **Using CocoaPods**

Run the `pod install` to receive the workspace that has the L11WAAP Mobile SDK integrated. Your **Podfile** should include:

```
use_frameworks!
pod 'Reblaze', :path => '${ReblazeSDK_root}/libs/iOS'
```

### **Include the ReblazeSDK framework manually**

* Drag `libs/iOS/ReblazeSDK.xcframework` , `libs/iOS/QEC.framework` to your project in the Project Navigator.
* Select your project and then your app target. Open the General panel.
* In *Frameworks, Libraries and Embedded Content* add **ReblazeSDK.xcframework and QEC.framework** and mark as *Embed and Sig&#x6E;**.***

## Finding the app Signature <a href="#finding-the-app-signature" id="finding-the-app-signature"></a>

Your **backendUrl** points to your application server, protected by the L11WAAP web proxy. You must configure this proxy to recognize the *signature* of your app. To find the signature of your app, you can open the Apple Development Certificate in the Keychain app, and copy the **SHA-256 fingerprint**. Alternatively, you can [extract](https://stackoverflow.com/a/14885447) this fingerprint from the **ipa** bundle. Upload it to the L11WAAP console, making sure that it contains hexadecimal characters only, in lowercase, without spaces.

During testing, you may allow running the app on Simulator. The simulator generates a special DEBUG signature: `"abadbabe"`. Note that you can also use [Offline Testing](/mobile-sdk-v2.3.0/developer-guide-sdk-v2.3.0.md#offline-testing-mock) both on Simulator and on a physical device.  The DEBUG signature "abadbabe" can be used for running the application on Simulator (emulator) and devices in the debug mode. To use it add "abadbabe" to the signatures section and make it active:

<figure><img src="https://2556271564-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FG1lK8HrOf2KYcim5ESTg%2Fuploads%2FZcAZvTrSWsvqDjGXrhW8%2FMonosnap%20rbzdev12345678%20%7C%20Mobile%20Application%20Groups%20Editor%202025-03-04%2015-01-59.png?alt=media&amp;token=0561f3c7-ec8a-4ac2-b8ae-4f6e8c768383" alt=""><figcaption></figcaption></figure>

There is a protocol between the SDK and the backend that negotiates the signature remotely and notifies the system of a new one, if such was generated. The communication between the components takes place under the /74d8-ffc3-0f63-4b3c-c5c9-5699-6d5b-3a1f endpoint, and when a new signature is introduced, it will be provided as a value for the header named "sig7" (see screenshot below), the signature can have 7 or more characters. This new signature shall then be added to the app signatures list under the Mobile SDK settings in the L11WAAP console. To find it easily in the Events Log, use this filter:

`url~74d8-ffc3-0f63-4b3c-c5c9-5699-6d5b-3a1f`

<figure><img src="https://2556271564-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FG1lK8HrOf2KYcim5ESTg%2Fuploads%2F8QUox9SRXHbO0Q6llJED%2FMonosnap%20rbzdev12345678%20%7C%20Events%20Log%202025-03-04%2014-55-49.png?alt=media&amp;token=d0277f3a-8f1a-412d-b482-95cc4116346a" alt=""><figcaption></figcaption></figure>

## Initialization <a href="#initialization" id="initialization"></a>

We recommend to configure the SDK by adding the `ReblazeSDK` string to iOS app **Info.plist**. This guarantees that the SDK will become activated as early as possible, sets **autoSign** and takes advantage of remote configuration.

If you want to configure the SDK programmatically, the best choice would be to configure the SDK in `application:didFinishLaunchingWithOptions:` method.

To access the SDK in your code, you must import **ReblazeSDK** as follows:

{% tabs %}
{% tab title="Swift" %}

```swift
import ReblazeSDK
```

{% endtab %}

{% tab title="Objective-C" %}

```objectivec
@import ReblazeSDK;
```

{% endtab %}
{% endtabs %}

Note that **autoSign** may be turned ON and OFF at any time, and this property is subject to [remote configuration override](/mobile-sdk-v2.3.0/developer-guide-sdk-v2.3.0.md#remote-configuration).

## Auto-signing and WebView <a href="#auto-signing-and-webview" id="auto-signing-and-webview"></a>

‌You can pass the **rbzsdk** header with a request that returns an HTML that you load into a WebView. But this approach does not support the links and resources (including AJAX) that are parts of that HTML. To handle these use cases, the Mobile SDK for iOS introduces *auto-signing*.

The SDK automatically signs all relevant requests as long as the application needs this. This applies not only to requests that originate in the WebView, but to all requests (based on **NSURLRequest** networking API, or any of the wrappers, like [Alamofire](https://github.com/Alamofire/Alamofire), [Moya](https://github.com/Moya/Moya), [FSNetworking](https://github.com/foursquare/FSNetworking), or [SwiftHTTP](https://github.com/daltoniam/SwiftHTTP)) that point to the designated backend. There is no collision if some request is [signed programmatically](/mobile-sdk-v2.3.0/developer-guide-sdk-v2.3.0.md#signing-the-network-requests).

While debugging the application, all auto-signed requests will be reported to your listener (see [**Monitoring the SDK**](/mobile-sdk-v2.3.0/developer-guide-sdk-v2.3.0.md#monitoring-the-sdk).

{% hint style="warning" %}
Auto-signing could be abused by malicious actors if they can achieve hostile takeover of your app. That's why we strongly recommend that all our customers apply obfuscation and runtime protection techniques for their apps.

To reduce the attack surface, you may choose to turn *auto-signing* on only while a relevant WebView is active.
{% endhint %}