A mobile security team should evaluate cross-app identity signals by listing the journeys where one of your apps trusts another, or where the same customer appears in several of your apps, and asking what evidence links them. Otukan supplies that evidence. Every app you publish reports the same signal types, handoffs between your apps are checked at both ends for a genuine signed release, and your servers can join installations across apps under a pseudonymous identifier you control. Linking stays inside your own apps and inside the limits Android and iOS set for a single developer. It adds context to your identity decisions; it does not identify the person.
The flows at stake
Where one app vouches for another
Many organisations now run a family of apps: a main banking app, a separate card or wallet app, an authenticator, a business app. Customers approve a sign-in in one and a payment in another, or open the wallet from a link in the banking app. Each of those handoffs is a trust boundary. The receiving app has to decide whether the request really came from your app, and whether that app is intact.
Where the same customer appears twice
The same person onboarding in two of your apps, or the same device holding a dozen accounts across them, is valuable information for your fraud team. Without shared signals it stays invisible, because each app only sees itself.
| Journey | Trust boundary | What goes wrong without signals |
|---|---|---|
| Approve sign-in from a companion app | Companion app to identity service | A look-alike app collects the approval |
| Open one app from another | App-to-app link | A rogue app injects a crafted request |
| Onboard in a second app | Second app to onboarding service | A known mule starts again with a clean slate |
| Pay from a wallet linked to a bank account | Wallet to payments backend | A tampered wallet sits beside a clean banking app |
Who does what
The operating systems
The platforms set the limits. On Android, a receiving app can identify the calling app for many kinds of interaction and check its signing certificate, and the Android identifier is shared by apps signed with the same key on the same device and user. On iOS, the vendor identifier is shared by apps from the same developer on a device, keychain access groups and app groups let apps from the same team share data, and a link opened by another app names its sender only when both come from the same team. Where the platform does not reveal the sender, Otukan confirms the handoff through your server. Otukan works within those limits on each platform and does not carry one platform’s mechanism across to the other.
Your apps with Otukan
Each app runs its own protection, reports its own integrity and device state, and checks the sender of every handoff it accepts. All apps describe what they see in the same vocabulary, so a hooking signal from the wallet means the same thing as one from the banking app.
Your servers
Your identity and fraud services decide which signals to link, for which purposes and for how long. They join installations across apps, compare them with the journey you expected and apply your policy. The link lives on your side, and you can switch it off per app or per purpose.
Evaluating it
Platform scope
Ask for Android and iOS answers separately: how handoff senders are verified, which identifiers are shared and under which signing or team conditions, and what happens when a customer removes one of your apps.
Evidence
In an authorised lab, send a handoff from a look-alike app and confirm it is ignored. Pair a tampered wallet with a clean banking app and confirm the approval is refused. Install two of your apps on different phones for one account and confirm the mismatch is reported. Then run the normal journeys on a single phone and confirm nothing fires. Repeat the set whenever one app in the family ships a release that changes a handoff.
Customer impact and privacy
Check that customers with only one of your apps see no extra friction. Have your privacy team review what is linked, why, and for how long, and make sure the privacy notice for each app describes it. Data handling is described on data flows and access.
To see how cross-app signals sit beside sign-in, biometric and installation controls, return to identity and account protection. For a single app where one login opens payments, mobility, commerce and partner mini-apps, see superapps application security.