How it works?

Four things are defined in the configure block: who will attest, which key will be used for encryption, where the nonce comes from, and where the result will be sent. This is done once and the same instance is used throughout the app.

The process starts when execute is called. sentinel.inspect() scans the current device state and produces a report. This report is combined with the platform token from attestProvider - Play Integrity on Android, App Attest on iOS. A one-time nonce is taken from the nonce block and added to the package. The resulting payload is encrypted with AES, and the AES key is encrypted with the RSA public key. Everything is packaged into an EncryptedAttestation object.

Then callbacks takes over. verify receives the encrypted package - posting it to your own API is your responsibility.

The Sentinel report and platform token are not sent separately - they go inside a single encrypted envelope. The server opens the envelope and evaluates both together.