Mobile attestation setup

Mobile tokens carry an attestation of the app. The device solves a proof of work and attests the app; your server verifies the token with expectedApp.

iOS: App Attest

1. In Xcode, add the App Attest capability to your app target. Use development while you develop and production for TestFlight and the App Store.
2. In the dashboard, open your site, add your iOS app under Apps (Team ID and bundle id). For the DeviceCheck fallback, also upload your DeviceCheck key (.p8 and Key ID); it is sealed in your browser and never shown again.

Without the entitlement, or where App Attest is unavailable (the Simulator, most app extensions, older devices), the token carries a lower score.

Android: Play Integrity

1. In the Play Console, link a Google Cloud project and turn on the Play Integrity API.
2. In the dashboard, add your Android app under Apps: package name and the SHA-256 of its app-signing certificate.
3. Upload the JSON key of a service account in that Cloud project (sealed in your browser, never shown again).
4. Pass the Cloud project number to the SDK as cloudProjectNumber.

Without a project number the SDK does not call Play, and the score is capped (0.5 by default). The same cap applies on an emulator without Play, a device without Play services, or a Google outage.

On your server

const outcome = await rg.verify(token, {
  expectedApp: { platform: 'android', id: 'com.example.app' }, // iOS: { platform: 'ios', id: 'com.example.App' }
  expectedAction: 'login',
  minScore: 0.6, // above 0.5: an app token with no attestation evidence scores at most 0.5
});

Never choose between the hostname and the app expectation from anything the client controls. Use one endpoint per platform, or decide from what your server already knows about the request. Mobile app checks are part of the Business plan.