Know what is calling your mobile app's backend.
Your app talks to an API, and so can anything that copies its requests. Proof of Actor classifies the traffic reaching your mobile backend, so you can treat your own app, agents and unknown clients differently.
POST /v2/bookings
Evidence
Your app reported that its in-app assistant drafted this booking for the signed-in user
Your policy: Allow, label AI-assisted and ask the user to confirm
Your mobile API is public, even if your app is not.
Every request your app makes can be replayed by a script or an AI agent. Assistants on the phone itself are also starting to operate apps for their users. To your backend, all of it looks like the same API call with the same token.
Proof of Actor works where every mobile request lands: your backend. It reads the evidence each request carries, records what your app declares about its own assistant features, and reports Unknown when the evidence runs out.
- Who is calling?Actor identity: signature, declaration or inference
- Which credential?Your API key, OAuth token or session
- What may it do?Your authorization and policy
Proof of Actor answers the first. Your stack keeps the other two.
What mobile teams do with actor context
Classify at the backend
Run the server or edge integration in front of the API your app uses. No app release needed to start.
Spot agents and scripts
See requests that carry agent signatures or declarations, and separate them from your app's own traffic.
Label in-app AI
When your app's own assistant acts for a user, report it so those requests are recorded as Human + AI.
Guard high-impact actions
Ask for confirmation or a stronger credential on bookings, payments and account changes when the evidence is weak.
See usage by endpoint
Understand which endpoints people, assistants and automated clients use most.
Native SDKs next
Native iOS and Android SDKs are on the roadmap. Founding teams help shape what they collect.
01 · Detect
Evidence from the requests your backend receives.
The server, edge or HTTP API integration reads request context, signatures and declared client details on every call to your mobile API.
- Request context at your API gateway, edge or server.
- Signed requests from agents that publish their keys.
- Declarations from your app about its own assistant features.
- Request signaturevalid · sample-crawler.exampleverified
- Client declaration"research-assistant/2.1"declared
- Browser interactionpointer + keyboard eventsinferred
- No supported signalsroute not instrumentedunknown
02 · Understand
Know who uses each endpoint.
Compare the actor mix across login, search, booking and account endpoints, and see where unknown clients concentrate.
- Actor mix per endpoint and app version.
- The evidence behind every result.
- Unknown rate per endpoint.
- /dashboardUnknown 7%
- /api/v1/catalogUnknown 15%
- /support/ticketsUnknown 8%
- /signupUnknown 21%
03 · Route
Policies that match the action.
Keep reads fast, add confirmation for AI-drafted actions, and ask for stronger credentials where the impact is high.
- Policies per endpoint, actor class and basis.
- Step up to a stronger credential when it matters.
- Observe, preview, then enforce.
- /api/v1/catalogenforceAgentAllow · structured API
- /support/ticketsenforceHuman + AIAllow · label AI-assisted
- /account/*previewUnknownKeep existing checks
- /api/v1/orderspreviewAgentRequire stronger credential
Example decisions
From request to result to your decision.
Your in-app assistant books for a user
Request
POST /v2/bookings
Result
Human + AIbasis: declaredYour decision
Allow, label it AI-assisted and ask the user to confirm.
A signed agent searches availability
Request
GET /v2/availability
Result
Agentbasis: verifiedYour decision
Allow the read with the agent rate limit.
A token reused with no other evidence
Request
POST /v2/account/email
Result
Unknownbasis: unknownYour decision
Keep your existing verification step. No actor-based decision.
Roll out without risk
Teams start in observation mode and move route by route.
- 01
Observe at your backend
Run the server or edge integration in front of your mobile API. No app release is needed to start.
- 02
Preview per endpoint
See how booking, search and account endpoints would be treated, including requests your own assistant declares.
- 03
Enforce on high-impact calls
Add confirmation or a stronger credential where the evidence is weak, starting with the riskiest endpoints.
Works with your stack
- Founding teams
Web server middleware (Node.js)
Server-side
Request-level signals for server-rendered apps and APIs.
- Founding teams
Next.js
Server-side and edge
Middleware for page and API routes.
- Founding teams
Browser script
Browser signals only
Interaction signals from browser sessions, alongside a server-side integration.
- Founding teams
Cloudflare and edge runtimes
Edge
Signals at the edge before requests reach your origin.
- Founding teams
Generic HTTP API
Any stack
Send request context to an API and receive a result with its basis.
- Founding teams
MCP server
MCP
Actor context for MCP tool calls.
- Roadmap
WordPress
Plugin
Plugin for WordPress sites.
- Roadmap
Native mobile
iOS and Android
Native iOS and Android SDKs.
Integrations are delivered hands-on with each founding team during onboarding. Using a different stack? Tell us when you apply.
Frequently asked questions
Is there a native iOS or Android SDK?
Not yet. Native SDKs are on the roadmap. Today Proof of Actor runs at your backend through the server, edge or HTTP API integration, which covers every request your app sends.
Do we need to ship a new app version?
No. You can start by integrating at your backend. Reporting in-app assistant use as a declaration is an optional addition to your own API.
Can it tell my real app from a script copying its requests?
It reports the evidence each request carries. Requests with no distinguishing evidence are reported as Unknown rather than guessed, and your policy decides how to treat them.
Does it replace our login or token checks?
No. Your authentication stays in charge. Proof of Actor adds who or what is acting, so your policies can respond better.
What does it cost?
Selected founding developer teams can receive up to 12 months free within agreed usage limits.
Bring actor context to your mobile backend.
Join the Proof of Actor founding developer program.
Prefer to talk first? Talk to the founders