Unity SDK

Configuration

Every field on ReflectConfig, what it does, and what to set in development vs. release builds.

Minimum config

ReflectSDK.Initialize(new ReflectConfig {
    BaseUrl       = "https://api.reflect.cloud",
    CompanyKey    = "co_live_…",
    AppKey        = "app_live_…",
    SigningSecret = "<shown-once-in-admin-apps>",
});

Field reference

Field	Type	Default	Notes
`BaseUrl`	string?	null	Server endpoint. Leave empty for debug mode (no network, overlay still works).
`CompanyKey`	string	—	Required when `BaseUrl` is set. Find at `Settings` in the admin panel.
`AppKey`	string	—	Required when `BaseUrl` is set. Per-app, find at `Apps`.
`SigningSecret`	string	—	Required when `BaseUrl` is set. Never commit.
`EnableLogging`	bool	false	Verbose Unity console logs. Gate on `Debug.isDebugBuild`.
`AutoSessionTracking`	bool	true	Auto-fire `app_open` / `session_start` / `session_end`.
`AutoCaptureCrashes`	bool	true	Auto-fire `_crash` on unhandled exceptions. Throttled to 1/min.
`BatchSize`	int	50	Events per HTTP batch.
`MaxQueueSize`	int	1000	Max events held offline. Oldest dropped past this.
`FlushIntervalSeconds`	float	30	Time-based flush trigger.
`RequireAdvertisingConsent`	bool	false	Block GAID/IDFA collection until `SetAdvertisingConsent(true)`. Recommended for EU.
`AutoRequestIosTracking`	bool	false	Auto-prompt ATT on iOS first launch. False = call `RequestIosTracking()` yourself when ready.
`Environment`	string	"production"	`"production"` \| `"sandbox"` — sandbox events are stored but excluded from billing/revenue dashboards.
`InstallEventTimeoutSeconds`	float	5	Backstop so `app_install` always fires even if native device/referral collection stalls or is stripped.
`AutoRegisterSkan`	bool	true	iOS only. Arm SKAdNetwork on launch — Apple requires this once or SKAN-driven installs go unreported.
`AutoResolveDeferredDeepLink`	bool	true	On first launch, ask the server to fingerprint-match a deferred deep link and raise `OnDeepLink`.
`CoppaCompliant`	bool	false	Child-directed apps: reports `ff_coppa` and suppresses advertising ids.
`CollectImei`	bool	false	China opt-in. Collect IMEI/MEID (Android; needs `READ_PHONE_STATE`, OS-blocked on 13+).
`CollectOaid`	bool	false	China opt-in. Collect OAID (needs the MSA/Huawei OAID SDK present).
`EnableDebugOverlay`	bool	false	Show the floating R button even when a real `BaseUrl` is set. Always gate on `Debug.isDebugBuild`.

Debug mode

Pass BaseUrl = null (or omit it) to run the SDK locally with the developer overlay but no network requests. Useful for:

Learning what the SDK collects without setting up a server
Verifying integration in CI / playmode tests
Demoing the SDK without exposing your prod keys

ReflectSDK.Initialize(new ReflectConfig {
    // No BaseUrl, no keys → debug mode.
    EnableLogging = true,
});

A red banner appears in-game and the floating R button opens the inspector. See Debug overlay.

Inspection mode

To run with a real BaseUrl AND keep the overlay visible:

new ReflectConfig {
    BaseUrl            = "https://...",
    CompanyKey         = "...",
    AppKey             = "...",
    SigningSecret      = "...",
    EnableDebugOverlay = Debug.isDebugBuild,   // ← gate this!
}

Don’t leave the overlay on in release builds.

Banner colour switches to amber so you notice, but always gate on Debug.isDebugBuild just in case.

Keeping secrets out of source

Build-time injection — read from an env var in a Custom Build script:

var secret = Environment.GetEnvironmentVariable("REFLECT_SIGNING_SECRET");

ScriptableObject ignored from git — store keys in a SO that lives outside source control; load via Resources.Load.
Server-side rotation — admin panel → Apps → Rotate secret on the app’s row. The new secret is revealed once, and the previous one keeps verifying for 48 hours, so builds already on devices go on reporting while you ship an update. Only one rotation can be in flight: the control reopens when that window closes.