devicecheck-app-attest-workflowlisted

Guide DeviceCheck and App Attest adoption in Apple-platform apps using DCDevice, DCAppAttestService, app IDs, entitlements, server challenges, attestation objects, assertions, receipts, fraud-risk metrics, sandbox/production environments, rollout planning, and explicit client/server handoffs. Use when implementing or diagnosing DeviceCheck per-device two-bit state, App Attest app-instance integrity, Apple server API validation, App Attest environment setup, macOS App Attest verification, App Clip key-sharing, supported extension contexts, or fraud-risk integration that must be checked against current Apple documentation.
gaelic-ghost/socket · ★ 6 · AI & Automation · score 69

Install: claude install-skill gaelic-ghost/socket

# DeviceCheck App Attest Workflow ## Purpose Guide DeviceCheck and App Attest implementation decisions without confusing app-side Apple framework calls with server-side trust decisions. The practical decision is whether the app needs DeviceCheck two-bit device state, App Attest app-instance integrity, both signals, or a different auth/session/sync workflow. The skill keeps Apple docs, Xcode signing state, server challenges, replay protection, rollout constraints, and backend handoffs visible before implementation starts. ## When To Use - Use this skill when adding or diagnosing `DCDevice`, `generateToken(completionHandler:)`, Apple DeviceCheck query/update/validate endpoints, or the two per-device bits Apple stores for an app. - Use this skill when adding or diagnosing `DCAppAttestService`, `generateKey(completionHandler:)`, `attestKey(_:clientDataHash:completionHandler:)`, `generateAssertion(_:clientDataHash:completionHandler:)`, or `DCError`. - Use this skill when the work involves App Attest App ID registration, DeviceCheck capabilities, the `com.apple.developer.devicecheck.appattest-environment` entitlement, sandbox versus production behavior, TestFlight or App Store rollout, Enterprise distribution, Developer ID, or macOS signing validation. - Use this skill when the app and server need a challenge, attestation, assertion, receipt, public-key, counter, or fraud-risk metric contract. - Use this skill when replacing custom device identifiers, local-only jailbreak chec