App Attestation & API Abuse From Fake Clients

Anyone can call your API with curl and a token from a real login. App attestation gives the server evidence that a request comes from your genuine, unmodified app on a genuine device: Apple App Attest (DeviceCheck) and Google Play Integrity API issue signed verdicts you verify server-side. Use attestation as a risk signal on sensitive actions (signup, payments, promo redemption), combined with rate limits and fraud scoring — not as authentication, and not as a hard requirement everywhere (devices fail attestation for benign reasons).

Client integrity tools

Python (risk-based gate)

async def redeem_promo(req: RedeemRequest, user: User, integrity_token: str | None):
    verdict = await verify_integrity(integrity_token, nonce=req.nonce) if integrity_token else None
    risk = score(user, req, verdict)               # attestation is one signal among many
    if risk > 0.9:
        raise Forbidden("action_blocked")
    if risk > 0.6:
        return step_up_challenge(user)             # e.g. OTP or captcha
    return await promos.redeem(user, req.code, idempotency_key=req.idempotency_key)

Common pitfalls

• Treating attestation as authentication.
• Hard-failing all requests when attestation is unavailable.
• Reusing attestation nonces (replay).

Key points

• Verify verdicts server-side with fresh nonces
• Use as a risk signal on sensitive actions
• Combine with rate limits and fraud scoring

Further reading: Google Play Integrity API