Device Integrity

Verify that requests to your server originate from genuine Apple devices running legitimate instances of your app. DCDevice provides per-device bits for persistent state (e.g., promo redemption), while DCAppAttestService provides cryptographic proof of app authenticity using Secure Enclave keys.

Security Boundary: App Attest proves client hardware/app integrity; it does not replace user authentication, TLS, authorization, or certificate pinning. Always enforce user authentication after App Attest verification succeeds.

Contents

• DCDevice (DeviceCheck)
• DCAppAttestService (App Attest)
• Key Generation & Attestation Flow
• Assertion Flow
• Error Handling & Key Lifecycle
• Common Mistakes
• Review Checklist
• References

DCDevice (DeviceCheck)