---
title: "Access Signals"
description: "Decide what each session is allowed to do based on the user's location, whether they are hiding it, and whether the connection is dangerous."
---
> For the complete documentation index, see [llms.txt](https://docs.doverunner.com/llms.txt).

**Add-on feature:** 
Access Signals is an add-on that requires a separate plan or contract. To use it, contact the [Help Center](https://support.doverunner.com).


**Access Signals** decides what each session is allowed to do based on where the user is, whether they are hiding it, and whether the connection is dangerous. It is applied at runtime alongside DoveRunner Mobile App Security.

Access Signals is configured in two places:

| Where | What you set |
| :---- | :----------- |
| [Sealing wizard, Step 6](#enabling-it-when-sealing) (or a preset) | Turn Access Signals on or off for each sealing. |
| [App Configurations](#policy-in-app-configurations) | Define the app's policy — country rules, anonymising infrastructure, and malicious IPs. |

## Requirements

- Sealing version **3.2.0.4 or higher**.
- Access Signals is active for your account. Until it is, Step 6 is not shown in the sealing wizard (or shows that Access Signals is not active), and App Configurations shows that the feature is not active.

## Enabling It When Sealing

On **Step 6 — Access Signals** of the [sealing wizard](https://docs.doverunner.com/mobile-app-security/android/android-sealing-options/#step-6--access-signals):

| Option | Values | Default | Description |
| :----- | :----- | :------ | :---------- |
| **Enable Access Signals** | On / Off | Off | Applies this app's Access Signals policy at seal time. |

Whenever Access Signals is enabled, the policy set in App Configurations is applied automatically.

## Policy in App Configurations

Open **Android Mobile App Security → App Configuration**, select the app, and go to the **Access Signals** section. There is no on/off switch here — Access Signals is turned on or off per sealing, as described above.

| Group | Signal | Settings |
| :---- | :----- | :------- |
| **Locate** | **Country Detection** | **Policy**: `Allow Only Selected` (every other region is closed) or `Block Selected` (every other region remains reachable).<br/>**Countries**: `All` (ISO 3166 countries and regions), `Quick Link` (a shareable list link), or `Custom` (select manually).<br/>**If location is unknown**: how to treat sessions whose location cannot be determined. |
| **Unmask** | **VPN Detection**, **Proxy Detection**, **Tor Detection**, **Residential Proxy Detection** | Block or allow traffic routed through each type of anonymising infrastructure. |
| **Judge** | **Malicious IP Detection** | Block or allow connections from known-bad infrastructure. |

Click **Save Configuration** to store the policy.

**Caution:** 
A `Block Selected` policy with no countries selected is invalid, and sealing with Access Signals enabled fails until you fix the country list or switch the policy.


## Using It with the CLI Tool

The CLI tool has no options for Access Signals. To apply it when you seal through the CLI, use a [sealing preset](https://docs.doverunner.com/mobile-app-security/android/android-preset/):


1. Set the app's Access Signals policy in App Configurations, as described above.
2. Open **Android → Preset** and create or edit a preset with sealing version 3.2.0.4 or higher.
3. In **Advanced Features**, turn on the **Access Signals** toggle, then save the preset. In a preset, Access Signals is a toggle in this section rather than a separate step.
4. Seal with the preset name:

   ```bash
   $ java -jar sealing.jar -url https://api.appsealing.com/covault/gw -authkey 123456789ABCDE -srcapk app-release.aab -sealedapk app-release-sealed.aab -sealing_preset_name my-preset-name
   ```


See [Using a Preset with the CLI Tool](https://docs.doverunner.com/mobile-app-security/android/android-preset/#using-a-preset-with-the-cli-tool) for the preset naming rules and the related warnings.