API Abuse Protection (App Attest / Play Integrity)

Instructions

Your mobile binary is not a trust boundary. Device attestation gives the server a signed statement from the OS that a request originated from an unmodified app on a real device — which you can weigh in authorization decisions.

1. What These APIs Prove (and Don't)

• App Attest (iOS) — the request came from a legitimate copy of your app, on a non-jailbroken device, signed by Apple. Does not prove the user's identity.
• DeviceCheck (iOS) — two bits of server-settable state per device, plus a basic "real device" signal. Complementary to App Attest.
• Play Integrity (Android) — the app binary is unmodified, installed from a recognized source, running on a device that passes Play Integrity ("MEETS_DEVICE_INTEGRITY"). Tiered; the strong tier ("MEETS_STRONG_INTEGRITY") requires hardware-backed attestation.

These defeat casual scripted abuse. They do not defeat a determined attacker with a rooted device plus an attestation bypass; treat them as probabilistic signals, not a yes/no gate.

2. Where to Use It