Client-Side Integration

Setup for platform integration, encryption, and server communication to verify app and device authenticity.

Dependency

implementation("co.rexiox:sentinel-attest:{version}")
implementation("co.rexiox:sentinel-crypto:{version}")

Configuration

SentinelAttest.configure {
    provider = attestProvider

    publicKey = "RSA_PUBLIC_KEY"

    nonce {
        // Retrieves a backend-generated nonce to uniquely bind and validate the attestation request.
        apiService.getSecureNonce()
    
        // Client-side nonce generation (not recommended, less secure than server-provided nonce)
        // generateSecureNonce()
    }
    
    callbacks {
        verify { encryptedAttestation ->
            // Receives the encrypted attestation payload and forwards it to the backend for verification.
            // apiService.verifyAttestation(body = encryptedAttestation)
        }

        onError { error ->
            // Called when an error occurs during attestation generation, encryption, or processing.
            print("Attestation faulted. Error Code: ${error.code}")
        }

        onComplete {
            // Invoked when the attestation pipeline completes, regardless of success or failure.
        }
    }
}

• provider The platform-specific component responsible for attesting the device. On Android this is Play Integrity, on iOS this is App Attest.

• publicKey The server's RSA public key. After the payload is encrypted with a randomly generated AES key, the AES key itself is encrypted with this public key before being sent to the server. This ensures the encryption key is transmitted securely - only your server, which holds the private key, can decrypt it.

• nonce A unpredictable, single-use value that eliminates the risk of replay attacks. Each execute call consumes one nonce. If an attacker intercepts and resends the same encrypted package, the server rejects it because the nonce has already been used.

• verify Called with the encrypted payload. Post this to your server using your preferred HTTP client (Ktor, OkHttp, Retrofit, etc.).

• onComplete Triggered when the attestation process finishes, regardless of whether it succeeded or failed.

• onError Triggered when an error occurs during the process (e.g. signing failure, encryption error).

Execute

sentinelAttest.execute(report = sentinel.inspect())