> For the complete documentation index, see [llms.txt](https://sentinel.rexiox.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sentinel.rexiox.co/attestation/client-side-integration.md).

# Client-Side Integration

### Dependency

```kotlin
implementation("co.rexiox:sentinel-attest:{version}")
implementation("co.rexiox:sentinel-crypto:{version}")
```

### Configuration

```kotlin
SentinelAttest.configure {
    provider = attestProvider

    publicKey = "RSA_PUBLIC_KEY"

    nonce {
        // Retrieves a backend-generated nonce to uniquely bind and validate the attestation request.
        apiService.getSecureNonce()
    
        // Client-side nonce generation (not recommended, less secure than server-provided nonce)
        // generateSecureNonce()
    }
    
    callbacks {
        verify { encryptedAttestation ->
            // Receives the encrypted attestation payload and forwards it to the backend for verification.
            // apiService.verifyAttestation(body = encryptedAttestation)
        }

        onError { error ->
            // Called when an error occurs during attestation generation, encryption, or processing.
            print("Attestation faulted. Error Code: ${error.code}")
        }

        onComplete {
            // Invoked when the attestation pipeline completes, regardless of success or failure.
        }
    }
}
```

* [**`provider`**](/attestation/attest-providers.md) The platform-specific component responsible for attesting the device. On Android this is Play Integrity, on iOS this is App Attest.
* **`publicKey`** The server's RSA public key. After the payload is encrypted with a randomly generated AES key, the AES key itself is encrypted with this public key before being sent to the server. This ensures the encryption key is transmitted securely - only your server, which holds the private key, can decrypt it.
* **`nonce`** A unpredictable, single-use value that eliminates the risk of replay attacks. Each `execute` call consumes one nonce. If an attacker intercepts and resends the same encrypted package, the server rejects it because the nonce has already been used.
* **`verify`** Called with the encrypted payload. Post this to your server using your preferred HTTP client (Ktor, OkHttp, Retrofit, etc.).
* **`onComplete`** Triggered when the attestation process finishes, regardless of whether it succeeded or failed.
* **`onError`** Triggered when an error occurs during the process (e.g. signing failure, encryption error).

### Execute

```kotlin
sentinelAttest.execute(report = sentinel.inspect())
```