device-integrity

Validate Apple device integrity using DeviceCheck and App Attest APIs.

Updated Apr 19, 2026

Search Tags:#security #integrity #fraud-prevention #devicecheck #backend-verification #server-verification #app-attest

Ready to run

npx skills add https://github.com/femitz/flyby --skill device-integrity-femitz

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: device-integrity
Source: https://github.com/femitz/flyby/tree/main/.agents/skills/device-integrity
Command: npx skills add https://github.com/femitz/flyby --skill device-integrity-femitz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Validate device integrity and app authenticity to prevent fraud and protect backend APIs by ensuring requests originate from genuine devices running unmodified apps.

Core Features & Use Cases

DeviceCheck-based token validation (per-device flags)
App Attest-based key generation, attestation, and assertion flows
End-to-end server verification patterns for secure API endpoints

Quick Start

Enable DeviceCheck and App Attest flows and wire server-side verification to start protecting your APIs.

Frequently Asked Questions about device-integrity

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I verify app integrity and validate Apple devices on my backend?▼

Verify app integrity by implementing DeviceCheck token validation and App Attest attestation flows on your server to confirm requests originate from genuine Apple devices running unmodified apps.

What is the difference between DeviceCheck and App Attest for fraud prevention?▼

DeviceCheck provides per-device token validation for setting persistent flags, while App Attest focuses on generating cryptographic keys and validating assertions to prove app authenticity and prevent fraud.

How do I set up server-side verification for App Attest assertions?▼

Set up server-side verification for App Attest by wiring your backend to validate cryptographic assertions and attestations, requiring secure key management to protect API endpoints from fraudulent requests.

When do I need App Attest and DeviceCheck for backend protection?▼

You need App Attest and DeviceCheck for backend protection when your APIs face fraud risks and must ensure that incoming requests come from unmodified apps on genuine Apple devices.

Can I use DeviceCheck to validate per-device flags on my server?▼

Yes, you can use DeviceCheck to validate per-device flags by generating tokens on the device and verifying them server-side, allowing you to track device state and prevent fraud.

What are the limitations of server-side app integrity verification?▼

Server-side app integrity verification depends on secure key management and proper implementation of DeviceCheck and App Attest flows, and requires handling attestation and assertion validation correctly to avoid API vulnerabilities.