Platform proofs · SecureLink

Platform proofs answer: “Is this request coming from a real app / install we trust?”

They are independent of auth mode. Turn them on or off with config.

Mobile

iOS — Apple App Attest (app-attest)
Android — Play Integrity (play-integrity)

createReactNativeSecureLink({
  attestationEnabled: true, // default
  getAttestationToken: async (challenge) => nativeModule.attest(challenge),
  // ...
});

Failed proof → server responds 403 Forbidden (PROOF_INVALID).

Extension

Each install gets a keypair. Requests include an installation proof bound to method/path/body.

createExtensionSecureLink({
  installationProofEnabled: true,
});

Web

No App Attest by default. Edge bot/browser challenges (e.g. Cloudflare) remain your infrastructure.

Server verification

createSecureLinkServer({
  attestation: {
    enabled: true,
    verifier: myProofVerifier, // optional custom verifier
  },
});