Project detail / Swift Package · Device security
AppAttestClient
A small Swift package for making an Apple App Attest flow practical: create a hardware-backed key, attest it once, and sign real requests with assertions.
The problem
An API secret embedded in a mobile app is not a reliable way to identify the app. App Attest offers a stronger boundary, but its lifecycle has real edge cases: a device can be restored, a key can disappear, a counter can drift, and a server can reject an attestation. The client layer needs to make that lifecycle manageable.
What shaped the build
The details are the product.
01
Keep the public surface focused
The package is dependency-free and Swift Package Manager compatible. Its job is not to hide every security decision; it gives an app a small, understandable path for challenges, attestation, and assertions.
02
Use the hardware-backed primitive
The key is created in the Secure Enclave. The application signs a one-time server challenge and later makes per-request assertions, without embedding a long-lived client secret in the binary.
03
Design for lifecycle failures
The implementation accounts for key regeneration after restore or reinstall, counter drift, and attestation rejection—the conditions that distinguish a demo integration from a dependable client package.
How it fits together
APP ATTEST / TRUST FLOW
Server
Issues a one-time challenge
Device
Secure Enclave creates and attests a key
Server
Verifies attestation, then accepts assertions