Introduction

Measura is a mobile measurement partner for Android. When someone installs your app, it matches that install back to the click that caused it, and records how it reached that conclusion: which signal matched, how strong the match was, and which other candidates it considered and rejected.

Most attribution tools return a verdict. The difference here is the reasoning, which means you can audit a number you do not believe instead of arguing about it.

They are tried in that order and the first match wins, so a deterministic answer is never replaced by an inferred one.

dependencies {
    implementation 'dev.measura:measura-sdk:0.1.0'
}

The archive is under 64 KB gzipped, enforced by a build gate at the same figure, so the number here cannot drift from what ships. Your APK grows by more than the archive: budget about 310 KB in a minified release build, most of it AndroidX WorkManager and the Room storage backing its job queue, and less if you already use Kotlin coroutines. It declares the permissions it needs, so manifest merging handles those for you.

Create an account to get an API key. It looks like msr_ followed by 64 characters and is shown once, when you create it.

import android.app.Application
import dev.measura.sdk.Measura
import dev.measura.sdk.core.EventType

class MyApplication : Application() {
    override fun onCreate() {
        super.onCreate()
        Measura.init(this, "msr_your_key_here")
    }
}

// Then anywhere in your app:
Measura.trackEvent(
    EventType.PURCHASE,
    mapOf("revenue" to 49.99, "currency" to "USD")
)

The install event and the first session fire automatically. There is nothing else to wire up.

Call init in Application.onCreate, not from an activity or behind a lazy check. This is a requirement rather than a convention. The SDK stores events that cannot be sent yet, and drains them later from a background worker that the system may start when your app is not running. That worker only has an API key if Application.onCreate supplied one. Initialise anywhere else and the worker will wake on schedule, find no credentials, and do nothing, so a queue built up on a bad connection never empties. Nothing throws, and the only sign is a line in logcat.

If you need consent before tracking, initialise normally and call Measura.disableTracking() until the user agrees. That decision is written to disk immediately and survives the process being killed, so events are dropped rather than queued, and the background drain still works once consent is given.

Sending without the SDK

Any backend can post signed events directly. Each one carries an HMAC-SHA256 signature over a canonical payload, so the ingest endpoint needs no session. See event ingestion for the exact canonicalisation rules.

An install arrives as an event. Within seconds a worker looks for a click that could have caused it, inside the attribution window configured for that app, and walks the signals in the fixed order above until one matches.

• Deterministic matches use an identifier that appears on both sides: a click id carried through the Play Install Referrer, or an advertising id.
• Probabilistic matching compares a device fingerprint hash. It is an exact hash comparison, not a similarity score, so a near miss does not match at all.
• Organic means nothing matched. That is recorded as a result rather than left blank.

Every attribution carries a score from 0 to 100. It starts at the base for whichever signal matched, then moves for things that make the match more or less believable: how unique the device signal is, how long passed between click and install, whether the IP is shared, and what the fraud pre-screen thought.

A score below 20 is downgraded to organic, and the evidence is still kept. A number you can inspect is worth more than a high number you cannot.

For every attribution Measura stores the matching method, the signals used, a written reason, the confidence breakdown, and the candidate clicks it rejected with the reason for each rejection.

That last part is unusual and it is the point. When an install is attributed somewhere you did not expect, you can see the click that won, the clicks that lost, and why. Read it through resource=attribution_log.

Why Android only

Android is the overwhelming majority of the market Measura is built for, and it carries the strongest attribution signal available anywhere: the Play Install Referrer passes a click identifier through the store install, which makes the match deterministic rather than inferred.

One platform means the SDK stays small, the offline behaviour is properly tested, and the size budget is enforced on every build. That is a better outcome than four SDKs of uneven quality. If you need another platform, the ingest API is documented and accepts signed events from anything.