App attestation
Play Integrity and App Attest checks for selfies sent from native apps.
Sekyro checks that a selfie submitted by a native app comes from your genuine app on a genuine device, using Google Play Integrity (Android) and Apple App Attest (iOS). You do not need a Google Cloud project or an Apple key: the Sekyro SDK uses Sekyro's own Play Integrity project, and App Attest needs no key to verify.
1. Register your app's platforms (Sekyro dashboard → Apps → your app → Platforms)
Android
- Package name, e.g.
mr.example.sales. - Signing certificate SHA-256 digests (up to 5). Add:
- the app signing key from Play Console → Setup → App integrity → App signing (this is what users install);
- your upload key and, for internal test builds, your debug key
(
keytool -list -v -keystore ~/.android/debug.keystore -alias androiddebugkey -storepass android). Paste the SHA-256 with or without colons.
iOS
- Bundle id, e.g.
mr.example.sales, and your 10-character Team ID (developer.apple.com → Membership). - In Xcode → Signing & Capabilities, add App Attest. Set the entitlement
com.apple.developer.devicecheck.appattest-environmenttoproductionfor App Store / TestFlight builds (developmentbuilds are accepted and marked as such).
Nothing else is needed on your side: no Google Cloud project, no Play Integrity API key, no Apple private key.
2. Modes (set by Sekyro staff for your organization; shown read-only in your settings)
| Mode | What happens |
|---|---|
signal (default) | The device is checked and the result is recorded with the verification. A failed check never blocks anyone. |
enforce | A failed device check fails the selfie attempt ("We couldn't verify this device"). The person can try again within the attempt limit; after the last attempt the verification is rejected. |
off | No device check is requested. |
If Google or Apple is unavailable, enforce behaves like signal for that request, so honest
users are never rejected because of an outage. Sandbox sessions are never enforced.
3. Errors you may see during integration
platform_unregistered(HTTP 400, not retryable): the app submitted from Android or iOS, but that platform is not registered on the app (or the key belongs to another app). Fix the registration; the SDK shows a setup message.app_attest_invalid(HTTP 400): App Attest key registration was refused — usually a missing App Attest capability, a wrong Team ID or bundle id, or a jailbroken device.too_many_challenges(HTTP 429): too many App Attest challenges are open for one session; the SDK waits and retries.- Reason
device_integrity_failed(retryable): underenforce, the device check failed — a modified or emulated phone, an app not installed from Google Play, or a debug build whose certificate is not registered.