Agent skill · security · dpearson2699
device-integrity
Verify device legitimacy and app integrity using DeviceCheck (DCDevice per-device bits) and App Attest (DCAppAttestService key generation, attestation, and assertion flows). Use when implementing fraud prevention, detecting compromised devices, validating app authenticity with Apple's servers, protecting sensitive API endpoints with attested requests, or adding device verification to a backend architecture.
Why this skill is useful
Provides specific implementation patterns and code snippets for integrating Apple's DeviceCheck and App Attest services, which are not widely known.
What it needs
Requires apple account access. About 8k tokens when loaded. Last updated 2026-07-31. 973 stars on the source repository.
What this skill does
Device Integrity Verify that requests to your server come from a genuine Apple device running a legitimate instance of your app. DeviceCheck provides per-device bits for simple flags (e.g., "claimed promo offer"). App Attest uses Secure Enclave keys and Apple attestation to cryptographically prove app legitimacy on sensitive requests. Contents DCDevice (DeviceCheck Tokens) DCAppAttestService (App Attest) App Attest Key Generation App Attest Attestation Flow App Attest Assertion Flow Server Verification Guidance Error Handling Common Patterns Common Mistakes Review Checklist References DCDevice (DeviceCheck Tokens) DCDevice generates a unique, ephemeral token that identifies a device. Treat each token as single-use: generate a new token for each server operation instead of caching or reusing one. The token is sent to your server, which then communicates with Apple's servers to read or set two per-device bits. Available on iOS 11+. Token Generation Sending the Token to Your Server Server-Side Overview The server exchanges each fresh token with Apple's authenticated DeviceCheck API. Load DeviceCheck Server Endpoints for endpoint and environment details. What the Two Bits Are For Apple stores two Boolean values per device per developer team. You decide what they mean. Common uses: Bit 0: Device has claimed a promotional offer. Bit 1: Device has been flagged for fraud. Bits persist across app reinstall. You control when to reset them via the server API. DCAppAttestService (App Attest) DCAppAttestService validates that a specific instance of your app on a specific device is legitimate. It uses a hardware-backed key in the Secure Enclave to create cryptographic attestations and assertions. Available on iOS 14+. The flow has three phases: 1. Key generation -- create a key pair in the Secure Enclave. 2. Attestation -- Apple certifies the key belongs to a genuine Apple device running your app. 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills dpearson2699/device-integrity