SDK (Software Development Kit)

An SDK (Software Development Kit) is a packaged collection of code, libraries, documentation, and tools that a developer integrates into an app to add a capability without writing it from scratch. In mobile growth, the SDK is the integration unit: when you "add AppsFlyer" or "add Firebase," you're embedding their SDK, which then collects events and talks to their servers.

Why every growth platform ships an SDK

• Attribution / MMPs ([[mmpGlossaryMobile Measurement Partner (MMP)A third-party attribution provider (AppsFlyer, Adjust, Singular, Branch, Kochava) that adjudicates which ads drove which installs across multiple ad networks, with i...]]) — the SDK records installs, sessions, and in-app eventsGlossaryIn-App Events (iOS)Time-bound events promoted directly on the iOS App Store — sales, content drops, tournaments, major updates — that appear as cards on your product page and in search... and attributes them to ad sources.
• Analytics — product analyticsGlossaryApp AnalyticsThe practice and tooling of measuring in-app user behavior — events, funnels, cohorts, retention — to understand and improve how people use a mobile app. SDKs capture screen views, funnels, and custom events.
• Ad networks / mediation — ad SDKs request, render, and report on ads ([[ad-mediation]]).
• Monetization — subscriptionGlossarySubscriptionA recurring in-app purchase that charges the user on a fixed cadence (weekly, monthly, annual) until they cancel./paywallGlossaryPaywallThe in-app screen that asks the user to subscribe or buy — the single most revenue-sensitive surface in a subscription app. SDKs manage purchases and entitlements.

SDK bloat is the accumulated weight of too many SDKs: larger [[app-size]], slower builds, more crash surface, more third parties touching user data, and harder privacy compliance. Best practice is to keep the SDK stack lean and audit what each one collects.

SDK spoofing is a fraud technique where an attacker reverse-engineers the messages an SDK sends to its server and forges fake install/event traffic to steal attribution and ad spendGlossaryAd SpendThe total dollar amount deployed into paid user acquisition over a defined period — the input variable that drives all UA volume. — see [[ad-fraud]]. MMPs defend with signed, encrypted SDK communication and anomaly detection.