Device Integrity & Anti-Fraud (iOS)

Prove a request comes from a genuine, unmodified build of your app on a real Apple device — not a script, emulator, repackaged clone, or instrumented copy. Two Apple frameworks, different jobs:

• App Attest (DCAppAttestService) — cryptographic proof of app + device authenticity per request. A hardware key in the Secure Enclave signs your payloads; your server verifies. Use to gate money-moving and abuse-prone endpoints.
• DeviceCheck (DCDevice) — two persistent bits per device per developer, surviving reinstalls and factory resets. Use for coarse device-level flags (trial abused, promo redeemed, banned).

Neither is authentication or authorization — they answer "is this a legitimate client instance?", not "who is the user?". Combine with real auth (authentication) and never treat client-side results as trusted; all verdicts are made on your server.

• Companion primitives: Keychain, Secure Enclave, CryptoKit, and TLS/SPKI pinning live in swift-security.
• Sign-in (Apple/passkeys/OAuth): authentication. Android counterpart: Play Integrity + root/emulator detection in android-device-integrity.
• KMP boundary: expose a commonMain interface DeviceIntegrity and bind an iosMain actual; see expect-actual. Keep raw attestation objects out of shared code — pass opaque base64 through to your backend.