---
title: "App Configurations"
description: "Manage per-app settings for your sealed Android apps — services, Dex package selection, signing certificates, Hardware Key Attestation, Access Signals, Custom Blacklist, and account transfers."
---
> For the complete documentation index, see [llms.txt](https://docs.doverunner.com/llms.txt).

App Configurations holds the settings that belong to a **sealed app** rather than to a single sealing run. Some of them — the Dex package lists, the signing certificate entries, the Hardware Key Attestation detection mode and the Access Signals policy — are what the sealing wizard reads from, so configure them here before you seal.

Open **Android Mobile App Security → App Configuration**.

## Finding an App

Apps are listed as cards showing the app name, its package name, and the three toggles described below. The list shows apps sealed by you or your team members. Use the search box to filter by app name or bundle ID, and **SHOW MORE** to load further entries.

Click a card to open that app's configuration page.

## Per-App Toggles

These appear both on the app card and on the left side of the configuration page.

| Toggle | Description |
| :----- | :---------- |
| **Service** | Whether DoveRunner tracks hacking events for the app. Usage-based charges apply while it is on. Turn it off when you stop using an app or want to pause protection. |
| **Data Sealing** | Has no effect on apps sealed with version 3.x — Data Sealing was removed in 3.x and the toggle is still shown in error. See [Android DataSealing](https://docs.doverunner.com/mobile-app-security/add-ons/data-sealing/). |
| **Custom Blacklist** | Activates the Custom Blacklist feature for the app. The blacklist itself is edited in the [Custom Blacklist](#custom-blacklist) section, which stays locked until this toggle is on. |

Below the toggles, **Transfer Account → REQUEST TRANSFER** moves a sealed application to another DoveRunner account — useful when promoting an app from a POC account to production, or handing ownership to another team member.

**Note:** 
On accounts that use multiple keystores, the configuration page also has a **Manage KeyStore** section, and keystores are managed per app there instead of in the [Manage Keystore](https://docs.doverunner.com/mobile-app-security/android/android-manage-keystore/) menu.


## Package Selection for Dex Encryption

Feeds the **Dex Encryption → Selective** option on [Step 2 of the sealing wizard](https://docs.doverunner.com/mobile-app-security/android/android-sealing/). Selective encryption lets you choose which Java/Kotlin classes or packages are encrypted, to balance protection against cold-boot performance.

| Field | Description |
| :---- | :---------- |
| **Package or Class Name** | The target to encrypt. Placeholder: `Enter Package, Class Name or File Name`. |
| **Target Type** | `JAVA/Kotlin Class` — the named class only.<br/>`JAVA/Kotlin Package (Classes under the package)` — every class under the package. |

Click **ADD** to add the entry. Existing entries are listed below with a **DELETE** action.

**Caution:** 
If this list is empty, selecting `Selective` for Dex Encryption applies no encryption at all. Configure the list first, then seal.


## Package Selection for Dex String Obfuscation

Feeds the **Dex String Obfuscation → Selective** option on Step 2. Obfuscation operates at the package level only.

The section has two tabs:

| Tab | Effect |
| :-- | :----- |
| **INCLUSION LIST** | Packages whose strings will be obfuscated. |
| **EXCLUSION LIST** | Packages skipped during obfuscation, **even if they match the inclusion list**. Use it for third-party libraries or reflection-heavy code. |

Enter a package name — the field accepts wildcard patterns such as `com.thirdparty.sdk.*` — and click **ADD**. Each list shows its entry count in the tab label, and entries can be removed with **DELETE**.

## Manage Signing Certificates

Holds the certificate fingerprints that the **Enable Signing Certificate Identity Check** option on Step 2 compares against at runtime, to detect resigned or repackaged copies of your app.

Each entry has two fields:

| Field | Description |
| :---- | :---------- |
| **Certificate name** | A label of your choosing, so you can tell entries apart. |
| **SHA-256 fingerprint** | The certificate's SHA-256 fingerprint — 64 hexadecimal characters, without colons or spaces. |

You can also add entries in the sealing wizard when you turn on **Enable Signing Certificate Identity Check**.

Use **+ Add Certificate Entry** to add a row and **×** to remove one. You can store up to **5 entries**; the counter above the list shows how many are in use, for example `3 / 5 entries`. Click **Save Entries** to store them.

**Note:** 
Saved certificate entries are applied the next time the app is sealed — editing them does not change builds that already exist.


Multiple entries let you cover more than one valid signing identity, for example an upload key and a Play App Signing key, or a staging and a production certificate.

## Hardware Key Attestation

Sets which Hardware Key Attestation detection cases are enforced for the app — **Basic** (the three definitive cases only) or **Custom** (each case individually). Attestation itself is turned on per sealing, on Step 5 of the sealing wizard or in a preset.

Hardware Key Attestation is an add-on. See [Hardware Key Attestation](https://docs.doverunner.com/mobile-app-security/add-ons/hardware-key-attestation/) for the detection cases, the sealing options, and how to use it with the CLI tool.

## Access Signals

Holds the app's Access Signals policy — country rules, VPN / Proxy / Tor / Residential Proxy detection, and malicious IP detection. Access Signals itself is turned on per sealing, on Step 6 of the sealing wizard or in a preset.

Access Signals is an add-on. See [Access Signals](https://docs.doverunner.com/mobile-app-security/add-ons/access-signals/) for each signal's settings, the sealing options, and how to use it with the CLI tool.

## Custom Blacklist

The Custom Blacklist is part of DoveRunner's Over-the-Air (OTA) update service. It lets you block apps that DoveRunner's default blacklist does not cover, and push that list to installs already in the field.

**Note:** 
The OTA update service is not available on Trial or Professional plans. Contact the DoveRunner business team or the [Help Center](https://support.doverunner.com) to activate it under an Enterprise contract. The section stays locked until the **Custom Blacklist** toggle is on.


To add an entry, enter the **Package Name**, choose an **Action Type**, and click **ADD**:

| Action Type | Behavior when the package is detected |
| :---------- | :------------------------------------ |
| **Kill & Report** | Terminates the app and reports the detection. |
| **Report** | Reports the detection without terminating the app. |

### Draft and Published Lists

The section shows two tables, and understanding the split matters:

| Table | Meaning |
| :---- | :------ |
| **Custom Blacklist List** | Your working draft. Adding or deleting entries here has no effect on running apps. |
| **Published Blacklist List** | What is actually live and delivered to installed apps over the air. |

Editing the draft changes nothing until you click **PUBLISH**, which pushes the draft to the published list. Two further controls manage what is live:

- **STOP LIVE UPDATE** — stops delivering the published list to apps.
- **CLEAR PUBLISHED** — empties the published list.

For the blacklist to reach a sealed app, that build must also have had **Over the Air Update** enabled on [Step 5 of the sealing wizard](https://docs.doverunner.com/mobile-app-security/android/android-sealing/).