device-integrity

App Attest verifies device integrity by having a client generate a Secure Enclave-backed key, attest it with a server challenge, and sign subsequent requests. The server validates these assertions using stored public keys and replay counters.

DeviceCheck provides per-device integrity tokens and persistent boolean bits for risk controls, while App Attest handles Secure Enclave key attestation and per-request assertion signing. Both contribute to server-side authenticity checks in iOS client-server architectures.

Implement App Attest by generating a key, performing one-time attestation with a server challenge, and creating per-request assertions. Your server validates assertions by checking signatures, matching challenge hashes, and enforcing replay counter increments.

Yes, device integrity verification protects sensitive API endpoints by requiring App Attest assertions for ongoing requests. Server-side validation ensures signatures and challenges match, blocking tampered clients from accessing protected backend resources.

Anti-replay protection works by enforcing server-side assertion counter checks. Each valid App Attest assertion increments a counter, and the server rejects requests with duplicate or outdated counter values to prevent replayed signature attacks.