skills.rest
Roy-wonji
Roy-wonjiCOMMUNITY
Explore all skills by this author →
GitHub

device-integrity

Verify iOS device legitimacy and app integrity via DeviceCheck and App Attest.

Updated May 6, 2026
Search Tags:#fraud prevention#app attest#devicecheck#secure enclave#server verification#anti-replay#iOS security
One-click install
npx skills add https://github.com/Roy-wonji/claude-config --skill device-integrity-roy-wonji
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: device-integrity
Source: https://github.com/Roy-wonji/claude-config/tree/main/skills/swift-ios-skills/skills/device-integrity
Command: npx skills add https://github.com/Roy-wonji/claude-config --skill device-integrity-roy-wonji

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you prevent fraud and protect sensitive server endpoints by verifying that incoming requests originate from genuine Apple devices running your unmodified app.

Core Features & Use Cases

  • DeviceCheck per-device verification (DCDevice): Generate ephemeral device tokens and interpret/update per-device bits for lightweight fraud signals.
  • App Attest cryptographic proof (DCAppAttestService): Perform key generation, one-time attestation, and per-request assertions to prove ongoing app legitimacy.
  • Server verification guidance: Support a backend architecture that validates CBOR attestation, verifies certificate chains, confirms counters to prevent replay, and checks request-bound hashes.

Use case example: You run a backend for purchases and account changes and want to reject requests from compromised or emulated environments while keeping legitimate users fully functional across iOS device models.

Quick Start

Ask the AI to design a server-backed flow that uses DCDevice as a fallback while implementing App Attest key generation, challenge-based attestation verification, and assertion-based request signing for your sensitive endpoints.

Frequently Asked Questions about device-integrity

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify iOS app integrity and prevent server requests from compromised devices?▼

Verify iOS app integrity by implementing server-side validation of App Attest assertions and DeviceCheck tokens. This confirms requests originate from genuine Apple devices running your unmodified app, preventing fraud from compromised or emulated environments.

How does App Attest attestation work for backend fraud prevention?▼

App Attest attestation generates a Secure Enclave-backed cryptographic key on the device and proves its existence to your server using a one-time challenge. Your server validates the CBOR attestation payload and certificate chain to establish ongoing app legitimacy.

Do I need DeviceCheck if I am already using App Attest for device verification?▼

DeviceCheck provides lightweight, per-device fraud signals using ephemeral tokens and modifiable bits, serving as a fallback. App Attest provides stronger cryptographic proof per request, so combining both offers layered fraud prevention for sensitive endpoints.

What is the best way to prevent replay attacks during iOS server verification?▼

Prevent replay attacks during iOS server verification by designing strict server challenges and validating counter values within App Attest assertions. Your backend must verify request-bound hashes and check counters to reject duplicated legitimate requests.

How do I handle Secure Enclave key lifecycle management for App Attest?▼

Handle Secure Enclave key lifecycle by generating keys via DCAppAttestService, performing one-time attestations, and using those keys for per-request assertions. Your server must manage the key state and reject requests using unattested or revoked keys.

Related Skills

Explore More Software Engineering Skills→
FelixRauchFelixRauch

device-integrity

Verify iOS device and app integrity with Apple DeviceCheck and App Attest.

Community
Advanced
DFly7DFly7

device-integrity

Verify iOS app requests using DeviceCheck tokens and App Attest assertions.

Community
Advanced
Kyon147Kyon147
489

shopify-app-integration-testing

Mock Shopify HTTP requests and verify routes and middleware in Laravel tests.

Community
Basic
jperezdelrealjperezdelreal

swift-security-expert

Audit and implement Keychain, biometrics, and CryptoKit security patterns on Apple platforms.

Community
Advanced