iOS quickstart

1. Create a site

In the dashboard, create a site and add your app under Apps. Copy the site key (rgpk_..., public) and the secret key (rgsk_..., shown once, server only). Choose the mode: invisible, checkbox or score (modes and thresholds).

2. Add the client

In Xcode: File, Add Package Dependencies, Add Local, choose sdks/ios. After the first release use Swift Package Manager with https://github.com/revokegpt/revokegpt-ios, from 0.1.0.

Add the App Attest capability to your app target (Signing & Capabilities), use development while you develop and production for TestFlight and the App Store, and add your app (Team ID and bundle id) under Apps in the dashboard. Where App Attest is unavailable (the Simulator, most app extensions, older devices) the SDK sends no attestation, or a DeviceCheck token, and the token carries a lower score. Requires iOS 15 or later and Swift 6 (Xcode 16 or later); no third-party dependencies.

3. Verify the token on your server

undefined

import RevokeGPT

// Once, at launch.
func configureRevokeGPT() async throws {
    try await RevokeGPT.shared.configure(Configuration(siteKey: "rgpk_..."))
    await RevokeGPT.shared.prewarm() // optional: makes the App Attest key ahead of time
}

// For each protected action.
func signupToken() async -> String? {
    do {
        return try await RevokeGPT.shared.execute(action: "signup")
        // Send the token to your server with the signup request.
    } catch let error as RevokeGPTError {
        print("revokegpt error", error.code) // never retry in a tight loop
        return nil
    } catch {
        return nil
    }
}

4. Read the score and the reasons

siteverify returns success, a score from 0.0 (bot) to 1.0 (human) in steps of 0.1, the action and hostname (or app) the token was issued for, and reasons, a list such as AUTOMATION or DATACENTER_IP. Always check success, the action and the hostname, then compare the score with a threshold you choose. 0.5 is a sensible start. For an app token use a threshold of 0.6 or higher: 0.5 is the cap for a token with no attestation evidence (a Simulator or emulator, a device without Google Play, or any script that claims one of these). See scores and reason codes and modes and thresholds.

5. Go live

The secret key is in your server’s secret store, not in source control, a page or an app.
The server checks success, the expected action, the expected hostname (or app) and a minScore.
A refused or failed verification blocks the action. Treat every failure as “do not accept”.
The token is sent over HTTPS and used once; a retry needs a new token.
Your site’s allowed domains (or apps) in the dashboard list the real production hostnames.
On the server, verify app tokens with expectedApp (platform and bundle id or package name), never with a hostname, and never choose between the two from anything the client controls.
Your Content Security Policy allows the widget origin if you have one (see session tokens and cookies).