---
title: "Basic Configuration"
description: "Learn about the basic configuration options and parameters for the DoveRunner Mobile App Security CLI tool."
---
> For the complete documentation index, see [llms.txt](https://docs.doverunner.com/llms.txt).


DoveRunner Mobile App Security CLI tool is jar file which can upload your APK/AAB and download it with DoveRunner Mobile App Security module installed.
You can use all configuration via command line which was visible in web console.

## CLI tool Options (for v3) (NEW)

This is the list of the available options when using sealing.jar file for Appsecurity version 3.0.0.0 or higher, for both Native (`NATIVE_AOS`) and Hybrid (`HYBRID_AOS`) apps.<br />
In 3.0.0.0 version, we replaced options to protect Dex files.<br />
In 3.2.0.0 version, `dex_encrypt` / `select_dex_encrypt` options were re-introduced (partial encryption only), and new options `use_callback_feature`, `disable_file_integrity_check`, and `enable_signing_certificate_identity_check` were added.<br />
In 3.3.0.0 version, per-threat [threat response policy](#threat-response-policies-from-3300) options (`action_*`) were added. Each threat can now be set to `block`, `monitor`, `callback`, or `allow`, and replace the legacy blocking options and `use_callback_feature`.<br />

:::tip[Which section should I read?]
- **New users:** Use a [preset](#example-usage-with-simple-options) (recommended), or set options directly using the tables below, including [threat response policies](#threat-response-policies-from-3300) for 3.3.0.0 or higher.
- **Using 3.2.x or lower:** Your existing options keep working on 3.3.0.0 or higher — the server converts them automatically. To find the new option for each legacy option, or for options of 3.0.0.0 ~ 3.2.x.x, see [Legacy Options](https://docs.doverunner.com/mobile-app-security/android/cicd/legacy-options/).
- **Native 2.x or Hybrid 1.x:** See [CLI tool Options (for v2.x and Hybrid)](https://docs.doverunner.com/mobile-app-security/android/cicd/legacy-options/#cli-tool-options-for-v2x-and-hybrid-).
:::

:::note[API Endpoint by Region]
| Region | URL |
|--------|-----|
| Global / Tokyo | `https://api.appsealing.com/covault/gw` |
| India (Mumbai) | `https://in-api.appsealing.com/covault/gw` |
| Indonesia (Jakarta) | `https://jakarta-api.appsealing.com/covault/gw` |
:::

### Common options

|Option|Description|Available Values|Required|Default Value|
|------|-----------|----------------|--------|-------------|
|&#x2011;url|Sealing API URL — select the endpoint for your region (see table above)|Regional URL|Required||
|&#x2011;authkey|Your account`s auth key. You can find this key at the CLI tool download page.| Provided separately|Required||
|&#x2011;srcapk|Source APK or App Bundle file which you need protect|file path of created APK or AAB|Required||
|&#x2011;sealedapk|Destination path including sealed file`s name which you need to download |file path of sealed APK or AAB|Required||
|&#x2011;service_type|DoveRunner Mobile App Security Hybrid has different version management, so if you are uploading Hybrid app such as ReactNative, Ionic, Cordova, you should put HYBRID_AOS here.|`NATIVE_AOS`, `HYBRID_AOS`|Optional|`NATIVE_AOS`|
|&#x2011;framework|This option is required when you are uploading HYBRID_AOS app.|`REACT_NATIVE`, `IONIC`, `CORDOVA`|Optional||
|&#x2011;service_version|DoveRunner Mobile App Security service version. <br />**- If you use `action_*` options, the resolved version must be 3.3.0.0 or higher, or the sealing request is rejected.**|`latest` or specific version like `3.3.0.0`|Optional|`latest`|
|&#x2011;deploymode|Test mode will show DoveRunner Mobile App Security watermark but you can test without any limit. Release mode will remove watermark, but it's MAD will be calculated as payed usage.|`test`, `release`|Optional|`test`|
|&#x2011;sealing_preset_name|Assigns a preset name created in the console. If managing individual options is cumbersome, you can configure a preset in the console and apply all settings collectively using this option. Some configurations (e.g., threat response message customization, Hardware Key Attestation, Access Signals) are only available through a preset and cannot be set directly via CLI.|Preset name string|Optional||
|&#x2011;app_signing|After DoveRunner Mobile App Security, app's signature is disabled. To install sealed app on smartphone, you need to sign your sealed APK or AAB manually or using this option. You can use registered_key option after register your keystore on DoveRunner Mobile App Security console.<br />**- `appsealing_key`: signs with a test (debug) key. Available for APK only — for AAB it is ignored and the app is left unsigned (same as `none`).**|`none`, `appsealing_key`, `registered_key`|Optional|`none`|

### Code protection options

|Option|Description|Available Values|Required|Default Value|
|------|-----------|----------------|--------|-------------|
|&#x2011;dex_string_obfuscation |It obfuscate Strings in classes.dex. <br />**Only applied to app's main packages.**<br />- `selective`: Only obfuscates strings in the class/package registered in App Configuration on the console. Register the target class/package in the console before using this value. (From 3.2.0.0)<br />**- `dex_string_obfuscation` and `dex_call_hiding` cannot both be `disable`.**|`disable`, `fast`, `balance`, `maximum`, `selective` |Optional|`balance`|
|&#x2011;dex_call_hiding |It obfuscates Method call flows in classes.dex. <br />**Only applied to app's main packages.**|`disable`, `fast`, `balance`, `maximum` |Optional|`balance`|
|&#x2011;dex_encrypt (From 3.2.0.0)|Re-introduced in 3.2.0.0. Enables DEX encryption. **Only partial (selective) encryption is supported — `dex_encrypt` and `select_dex_encrypt` must be set to the same value (`yes`/`yes` or `no`/`no`). Setting `dex_encrypt=yes` with `select_dex_encrypt=no` is ignored and no encryption is applied.**|`yes`, `no`|Optional|`no`|
|&#x2011;select_dex_encrypt (From 3.2.0.0)|Enables partial DEX encryption. **Must be used together with `dex_encrypt=yes`. Before using this option, register the target class/package in App Configuration on the console.**|`yes`, `no`|Optional|`no`|
|&#x2011;so_encrypt (From 3.1.0.0)|Doverunner server will automatically encrypt available SO fils under app's lib folder.<br />**- It does not encrypt SO files from the known 3rd party libraries, which can conflict with Doverunner.**|`yes`, `no`|Optional|`yes`|
|&#x2011;select_so_encrypt (From 3.1.0.0)|Doverunner server will encrypt your SO files based on your parameter.<br /> - `selective_so` parameter must have values to use this option. <br /> **- This option works only when `so_encrypt` is `yes`.**|`yes`, `no`|Optional|`no`|
|&#x2011;selective_so (From 3.1.0.0)|You can specify your SO files under lib folder of your app. Each SO file is separated by commas (,). <br />**- This option works only when `so_encrypt` and `select_so_encrypt` are both `yes`.**|`"libAAA.so,libCC.so,...libZZZ.so"`|Optional||
|&#x2011;disable_file_integrity_check (From 3.2.0.0)|Disables file integrity verification. Typically used when files are modified by Google before distribution (e.g., Play Protection, SideKick). Ensure an alternative integrity mechanism is in place before deploying to production.|`true`, `false`|Optional|`false`|
|&#x2011;enable_signing_certificate_identity_check (From 3.2.0.0)|Enables app signing certificate verification. Before setting to `true`, register the SHA256 signing hash in the console — go to the app's settings page and find **Signing Verification Management**. Enabling it without prior registration will not work correctly.|`true`, `false`|Optional|`false`|

### Threat response policies (From 3.3.0.0)

From 3.3.0.0, you set how the app responds to each threat with an `action_*` option.

| Action | Behavior |
|--------|----------|
| `block` | Blocks the app when the threat is detected. |
| `monitor` | Does not block. Only records the detection. |
| `callback` | Does not block. Delivers the detection to the callback implemented in the app. |
| `allow` | Allows the threat. No response. |

If you leave an `action_*` option empty, the default value in the table below applies.

:::caution
`action_*` options are only available for `service_version` 3.3.0.0 or higher. If you set any `action_*` value with a lower version — including when `latest` resolves to a version lower than 3.3.0.0 — the sealing request is rejected.
:::

|Option|Threat|Available Values|Required|Default Value|
|------|------|----------------|--------|-------------|
|&#x2011;action_rooting|Rooting|`block`, `monitor`, `callback`, `allow`|Optional|`allow`|
|&#x2011;action_emulator|Emulator|`block`, `monitor`, `callback`, `allow`|Optional|`allow`|
|&#x2011;allow_emulator|Allows specific emulators as exceptions. **You can use multiple options with comma.**|`BlueStacks`, `Nox`, `LDPlayer`|Optional||
|&#x2011;action_developer_options|Developer Options enabled|`block`, `monitor`, `callback`, `allow`|Optional|`allow`|
|&#x2011;action_usb_debugging|USB debugging enabled|`block`, `monitor`, `callback`, `allow`|Optional|`block`|
|&#x2011;action_work_profile|Work profile (e.g., Secure Folder)|`block`, `monitor`, `callback`, `allow`|Optional|`block`|
|&#x2011;allow_work_profiles|Allows specific work profile apps as exceptions.|`Samsung SecureFolder`|Optional||
|&#x2011;action_keylogger|Keylogger apps|`block`, `monitor`, `callback`, `allow`|Optional|`allow`|
|&#x2011;action_overlay|Overlay windows from other apps (Android 12+)|`block`, `monitor`, `callback`, `allow`|Optional|`allow`|
|&#x2011;action_macro|Macro (auto clicker) tools|`block`, `monitor`, `callback`, `allow`|Optional|`block`|
|&#x2011;action_sniff|Network sniffing / packet attack tools|`block`, `monitor`, `callback`, `allow`|Optional|`block`|
|&#x2011;action_malicious_tools|Malicious tools|`block`, `monitor`, `callback`, `allow`|Optional|`block`|
|&#x2011;allow_packages|Package names excluded from malicious tool detection. Separate multiple packages with commas.|`"com.example.tool1,com.example.tool2"`|Optional||
|&#x2011;action_app_integrity|App integrity (tampering)|`block`, `monitor`, `callback`, `allow`|Optional|`block`|

The options below are not threat response policies, but are applied at the same time.

|Option|Description|Available Values|Required|Default Value|
|------|-----------|----------------|--------|-------------|
|&#x2011;block_malware_detection (From 3.3.0.0)|Enables behavioral malware detection.|`yes`, `no`|Optional|`no`|
|&#x2011;block_screen_capture|When any screen mirroring or capturing app is trying to hijack an app's screen, it will only get a black screen. But this will not send any hacking detection report, and will not quit the app.|`yes`, `no`|Optional|`no`|
|&#x2011;wifi_security_protocol|You can collect smartphone's current Wi-Fi security protocol information such as `WEP`,`WPA`. When you enable this option, `android.permission.ACCESS_WIFI_STATE` is added to your application|`collect`, `disable`|Optional|`disable`|

:::note
Hardware Key Attestation, Access Signals and threat response message customization have no CLI options. To apply them, configure a preset in the console and set `sealing_preset_name`.
:::

:::note[Using 3.2.x or lower?]
The legacy threat options (`block_environment`, `block_*`, `hide_overlay_windows`, `allow_external_tool`, `use_callback_feature`) and how they map to `action_*` are described in [Legacy Options](https://docs.doverunner.com/mobile-app-security/android/cicd/legacy-options/).
:::

## Example usage with simple options
Example command line when you apply DoveRunner Mobile App Security with only required options. All other options will be applied as default values.

**Using a preset (Recommended):** Configure protection settings in the DoveRunner console as a preset, then reference the preset name. All protection options are managed from the console.
```bash
$ java -jar sealing.jar -url https://api.appsealing.com/covault/gw -authkey 123456789ABCDE -srcapk app-release.aab -sealedapk app-release-sealed.aab -sealing_preset_name my-preset-name
```

**Without preset:** All protection options use their default values.
```bash
$ java -jar sealing.jar -url https://api.appsealing.com/covault/gw -authkey 123456789ABCDE -srcapk app-release.aab -sealedapk app-release-sealed.aab
```

## Example usage with enabling all options
Example command line when you apply DoveRunner Mobile App Security 3.3.0.0 or higher on your App bundle with all options specified. For 3.0.0.0 ~ 3.2.x.x, see the [example in Legacy Options](https://docs.doverunner.com/mobile-app-security/android/cicd/legacy-options/#example-usage-for-3000--32xx).

```bash
$ java -jar sealing.jar -url https://api.appsealing.com/covault/gw -authkey 123456789ABCDE -srcapk app-release.aab -sealedapk app-release-sealed.aab -service_type NATIVE_AOS -service_version latest -deploymode release -dex_string_obfuscation balance -dex_call_hiding balance -dex_encrypt yes -select_dex_encrypt yes -so_encrypt yes -disable_file_integrity_check false -enable_signing_certificate_identity_check false -action_rooting block -action_emulator block -allow_emulator LDPlayer,BlueStacks,Nox -action_developer_options monitor -action_usb_debugging block -action_work_profile block -allow_work_profiles 'Samsung SecureFolder' -action_keylogger callback -action_overlay block -action_macro block -action_sniff block -action_malicious_tools block -allow_packages com.example.tool1 -action_app_integrity block -block_malware_detection yes -block_screen_capture yes -wifi_security_protocol collect -app_signing registered_key
```

When you use many options, managing them in a [config.txt file](#run-sealingjar-using-the-configtxt-file) is easier and less error-prone than a long command line.

When sealing with 3.3.0.0 or higher, the CLI tool prints the applied policies in a **Threat Policies** block of the sealing configuration output. Legacy options replaced by threat response policies are not printed.

## Run sealing.jar using the config.txt file

You can run CLI tool file with below option, and can manage all options at config.txt file.
```bash
$ java -jar sealing.jar -config ./config.txt
```

### config.txt file
The CLI tool package includes the `config.txt` below, based on 3.3.0.0 or higher. For older versions, use the example files in the `examples/` folder of the package.

| Version | Example file |
|---------|--------------|
| Native 3.3.0.0 or higher | `examples/config-for-native-v3.3.txt` |
| Hybrid 3.3.0.0 or higher | `examples/config-for-hybrid-v3.3.txt` |
| Native 3.0.0.0 ~ 3.2.x.x | `examples/config-for-native-v3.txt` |
| Hybrid 3.2.x.x | `examples/config-for-hybrid-v3.txt` |
| Native 2.x | `examples/config-for-native-v2.txt` |
| Hybrid 1.x | `examples/config-for-hybrid-v1.txt` |

<details>
<summary>View the full config.txt (3.3.0.0 or higher)</summary>

```
## DoveRunner AppSecurity CLI Tool - Configuration File
# Usage example: java -jar sealing.jar -config ./config.txt
#
# This file is based on AppSecurity 3.3.0.0 or higher.
# For older versions, refer to the example files in the examples/ folder.
#   3.0.0.0 ~ 3.2.x.x : examples/config-for-native-v3.txt, examples/config-for-hybrid-v3.txt
#   Native 2.x        : examples/config-for-native-v2.txt
#   Hybrid 1.x        : examples/config-for-hybrid-v1.txt

# Sealing API URL (Region-specific URLs: https://docs.doverunner.com/mobile-app-security/android/cicd/basic-configuration/)
url=https://api.appsealing.com/covault/gw

# Authentication Key (available in DoveRunner Developer Console)
authkey=

# Original APK/AAB file path
srcapk=

# Sealed APK/AAB output path
sealedapk=

# App signing option { none | registered_key }
# none : AppSecurity applied but not signed. Developer must sign before installing or distributing.
# registered_key : Signed with a key pre-registered in the DoveRunner Developer Console (https://console.doverunner.com).
app_signing=

# Sealing preset option. When set, security options below can be controlled from the console.
sealing_preset_name=


# App service type { NATIVE_AOS | HYBRID_AOS }
service_type=

# Hybrid app framework { REACT_NATIVE | IONIC | CORDOVA }
framework=

# Service version
service_version=

# Deploy mode { release | test }
deploymode=


# Dex obfuscation options (3.0.0.0+) - replaces legacy Dex encryption options.
# CAUTION: Both options cannot be set to 'disable' at the same time.

# Obfuscate strings in classes.dex { disable | fast | balance | maximum | selective } (default: balance)
dex_string_obfuscation=

# Obfuscate method call flows in classes.dex { disable | fast | balance | maximum } (default: balance)
dex_call_hiding=


# Dex encryption (3.2.0.0+) { no | yes }
# CAUTION: dex_encrypt and select_dex_encrypt must be set to the same value. (yes/yes or no/no)
dex_encrypt=

# Selective Dex encryption (3.2.0.0+) (only applies when dex_encrypt=yes) { no | yes }
select_dex_encrypt=

# SO file encryption (3.1.0.0+) { yes | no }
so_encrypt=

# Selective SO file encryption (3.1.0.0+) { yes | no }
select_so_encrypt=


# Disable file integrity check { true | false } (default: false (integrity check enabled))
# When set to true, file integrity check will not be performed.
# Typically used for Play Protection, SideKick and similar scenarios where files are modified by Google before distribution.
# Ensure an alternative integrity mechanism is in place before deploying to production.
disable_file_integrity_check=

# Enable signing certificate identity check { true | false } (default: false (disabled))
# IMPORTANT: SHA-256 certificate fingerprints must be registered in the DoveRunner Developer Console before enabling this option.
# Enabling without prior registration will not work correctly.
enable_signing_certificate_identity_check=


# Threat response policies (3.3.0.0+)
# Set the action taken when each threat is detected. { block | monitor | callback | allow }
#   block    : Block
#   monitor  : Do not block, only record the detection
#   callback : Instead of blocking, deliver the detection to the callback implemented in the app
#   allow    : Allow (no response)
# If left empty, the (default) of each item is applied.
# CAUTION: action_* options are only available for service_version 3.3.0.0 or higher.
#          Setting a value with a version lower than 3.3.0.0 causes the sealing request to be rejected.

# Rooting (default: allow)
action_rooting=

# Emulator (default: allow)
action_emulator=

# Allow specific emulators { BlueStacks, Nox, LDPlayer }
allow_emulator=

# Developer Options (default: allow)
action_developer_options=

# USB debugging (default: block)
action_usb_debugging=

# Work profile (default: block)
action_work_profile=

# Allow specific work profile apps { Samsung SecureFolder }
allow_work_profiles=

# Keylogger (default: allow)
action_keylogger=

# Overlay windows from other apps (Android 12+) (default: allow)
action_overlay=

# Macro tools (default: block)
action_macro=

# Network sniffing / packet attack tools (default: block)
action_sniff=

# Malicious tools (default: block)
action_malicious_tools=

# Package names excluded from malicious tool detection (comma-separated, e.g. com.example.tool1,com.example.tool2)
allow_packages=

# App integrity (default: block)
action_app_integrity=

# [Note] Compatibility with legacy (3.2 or lower) options
# Legacy options can still be used with 3.3.0.0 or higher; the server converts them into the actions above.
# If both a legacy option and action_* are set for the same item, action_* takes precedence.
#   block_environment=rooting       -> action_rooting=block
#   block_environment=emulator      -> action_emulator=block
#   block_developer_options=yes|no  -> action_developer_options=block|allow
#   block_usb_debugging=yes|no      -> action_usb_debugging=block|allow
#   block_work_profile=yes|no       -> action_work_profile=block|allow
#   block_keylogger=yes|no          -> action_keylogger=block|allow
#   hide_overlay_windows=yes|no     -> action_overlay=block|allow
#   allow_external_tool=macro       -> action_macro=allow
#   allow_external_tool=sniff       -> action_sniff=allow


# Behavioral malware detection (3.3.0.0+) { yes | no } (default: no)
block_malware_detection=

# Block screen capture and mirroring { yes | no }
block_screen_capture=

# Collect Wi-Fi security protocol information { collect | disable }
wifi_security_protocol=
```

</details>

### config.txt examples
Ex) Using execution script only for srcapk and sealedapk parameter and the rest for configuration file:

```bash
java -jar sealing.jar -config config.txt -srcapk app-release.apk -sealedapk app-release-sealed.apk
```

**Native**


Native app: App build with general Android Studio, Flutter, Unity, or Unreal engine.

```
url=https://api.appsealing.com/covault/gw
authkey=123456789ABCDE
service_type=NATIVE_AOS
service_version=latest
deploymode=release
app_signing=none
dex_string_obfuscation=balance
dex_call_hiding=balance
dex_encrypt=no
select_dex_encrypt=no
so_encrypt=yes
action_rooting=block
action_emulator=block
allow_emulator=BlueStacks, Nox, LDPlayer
action_usb_debugging=block
action_work_profile=block
allow_work_profiles=Samsung SecureFolder
action_keylogger=monitor
action_macro=allow
action_sniff=allow
action_malicious_tools=block
action_app_integrity=block
```


**Hybrid**


Hybrid app: App built with ReactNative, Ionic or Cordova. The example below is for a ReactNative app.

```
url=https://api.appsealing.com/covault/gw
authkey=123456789ABCDE
service_type=HYBRID_AOS
framework=REACT_NATIVE
service_version=latest
deploymode=release
app_signing=none
dex_string_obfuscation=balance
dex_call_hiding=balance
dex_encrypt=no
select_dex_encrypt=no
action_rooting=block
action_emulator=block
allow_emulator=BlueStacks, Nox, LDPlayer
action_work_profile=allow
action_keylogger=allow
action_macro=allow
action_sniff=allow
```



Notice:
For Windows Platform, double file separator must be used in path configuration with config.txt.
Ex) D:\\DoveRunner Mobile App Security\\sealing.jar