---
title: Set Up App and API Protection Products without using APM
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > App and API Protection > App and API Protection
  Guides > Set Up App and API Protection Products without using APM
---

# Set Up App and API Protection Products without using APM

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ().
{% /alert %}

{% /callout %}

Datadog AAP is built on top of [APM](https://docs.datadoghq.com/tracing.md). While Datadog recommends using AAP with APM and adopting DevSecOps practices, you can also use these security products without using APM. This configuration is referred to as Standalone App and API Protection. This guide explains how to set up Standalone App and API Protection.

## Prerequisites{% #prerequisites %}

This guide assumes you have the following:

- **Datadog Agent:** [Install the Datadog Agent](https://docs.datadoghq.com/agent.md) and configure it for your application's operating system, container, cloud, or virtual environment. [Infrastructure Monitoring](https://docs.datadoghq.com/infrastructure.md) is enabled by default in the Datadog Agent; disabling it requires version 7.77.0 or newer.
- **Supported SDK:** The Datadog SDK used by your application or service supports App and API Protection. For more details, see the guide for [App and API Protection](https://docs.datadoghq.com/security/application_security/setup.md).

## Compatibility{% #compatibility %}

Standalone App and API Protection is supported for the following SDK versions:

| Language | Version |
| -------- | ------- |
| .NET     | 3.12.0  |
| Go       | N/A     |
| Java     | 1.47.0  |
| Node.js  | 5.40.0  |
| PHP      | N/A     |
| Python   | 3.2.0   |
| Ruby     | 2.13.0  |

## Setup{% #setup %}

### Agent configuration{% #agent-configuration %}

Standalone App and API Protection uses the same Datadog Agent setup as APM. For more details, see the guide for [installing the Datadog Agent](https://docs.datadoghq.com/agent.md).

To disable Infrastructure Monitoring, set the Datadog Agent infrastructure mode to `none` using either:

- The `DD_INFRASTRUCTURE_MODE=none` environment variable
- The `infrastructure_mode: none` setting in the `datadog.yaml` configuration file

For more details, see the configuration page for [the Datadog Agent infrastructure mode](https://docs.datadoghq.com/agent/configuration/infrastructure-modes.md).

### SDK configuration{% #sdk-configuration %}

Standalone App and API Protection is configured at the SDK level using the following environment variables on the instrumented service: `DD_APM_TRACING_ENABLED=false` and `DD_APPSEC_ENABLED=true`.

`DD_APM_TRACING_ENABLED=false` limits the amount of APM data sent to the minimum required by App and API Protection. The environment variable can be combined with other [App and API Protection configuration options](https://docs.datadoghq.com/security/application_security/setup.md).