What problem does it solve?
Verify that requests to your backend originate from a genuine Apple device running your unmodified app, preventing fraud and automated abuse that rely on spoofed or tampered clients. This Skill helps teams avoid trusting client-side assertions and implements server-side validation of DeviceCheck tokens and App Attest attestations/assertions to reduce account takeover, fraudulent transactions, and replay attacks.
Core Features & Use Cases
- DCDevice tokens: generate and send device tokens to a server to read or set two per-device bits for simple flags like promotional claims or fraud markers.
- App Attest key lifecycle: generate Secure Enclave-backed keys, persist keyId, perform attestation with Apple's servers, and store the public key and receipt server-side.
- Assertion verification: generate per-request assertions that sign clientDataHash, verify CBOR-encoded assertions on the server, validate signatures against stored public keys, and enforce counter-based replay protection.
- Server responsibilities: challenge endpoints, attestation verification (certificate chain vs Apple's App Attest root CA), CBOR parsing, clientDataHash matching, counter tracking, and retry/backoff strategies for transient DCError failures.
- Use Case: protect high-risk endpoints (payments, account changes) by requiring an attested assertion with server-side verification and falling back to DeviceCheck tokens for unsupported devices.
Quick Start
Use the device-integrity skill to validate an App Attest attestation and verify an assertion for a sensitive API request.
