> For the complete documentation index, see [llms.txt](https://sentinel.rexiox.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sentinel.rexiox.co/attestation/how-it-works.md).

# How it works?

Four things are defined in the `configure` block: who will attest, which key will be used for encryption, where the nonce comes from, and where the result will be sent. This is done once and the same instance is used throughout the app.

The process starts when `execute` is called. `sentinel.inspect()` scans the current device state and produces a report. This report is combined with the platform token from `attestProvider` - Play Integrity on Android, App Attest on iOS. A one-time nonce is taken from the `nonce` block and added to the package. The resulting payload is encrypted with AES, and the AES key is encrypted with the RSA public key. Everything is packaged into an `EncryptedAttestation` object.

Then `callbacks` takes over. `verify` receives the encrypted package - posting it to your own API is your responsibility.

<figure><img src="/files/u0hMs29hzOjDy6to7IiD" alt=""><figcaption></figcaption></figure>

The Sentinel report and platform token are not sent separately - they go inside a single encrypted envelope. The server opens the envelope and evaluates both together.