device-integrity

Protect backend endpoints by validating DeviceCheck tokens and App Attest assertions to verify device authenticity. This coordinates per-device token generation with server-side cryptographic attestation verification to block fraudulent or tampered iOS app requests.

DeviceCheck reads per-device tokens to guard endpoints based on device state, while App Attest uses per-user cryptographic keys to prove app legitimacy. Combining both provides layered fraud prevention by validating both the hardware device and the app instance integrity.

Implement server-side verification by validating App Attest attestations and assertions on protected endpoints. This requires verifying the cryptographic proof from the iOS app, applying environment-aware replay protection, and confirming per-user attested keys match the expected device.

Yes, you can use DeviceCheck to read per-device tokens and guard server endpoints based on device state. Integrating these checks across your backend prevents fraud, tampering, and spoofing by ensuring only legitimate devices access protected API routes.

Yes, environment-aware replay protection is necessary for iOS device integrity checks to prevent assertion reuse. It defends backend services by ensuring attested requests and assertions are valid only within their specific intended environment, blocking replay attacks.

App Attest requires strict server-side verification of both attestations and assertions, plus environment-aware replay protection. Without properly coordinating per-user attested keys and validating cryptographic proofs, backend endpoints remain vulnerable to spoofing despite the attestation flow.