On this page

Architecture guide

Raw signals and attestation solve different problems

Use platform-backed tokens when you need a server-verifiable platform statement. Use transparent raw observations when you need field-level context, diagnostics, or cross-platform consistency.

The core difference

Play Integrity and App Attest are remote verification protocols. Their useful security properties depend on challenge or request binding and server-side verification. React Native Device Risk Signals is a local observation library. It returns values your app can inspect and serialize, but those values remain attacker-influenced.

Choose the layer by the claim you need

CapabilityRaw device signalsPlatform attestation
OutputTyped paths, properties, classes, libraries, runtime and device observationsSigned or server-decoded platform verdict or assertion
TransportNone in the SDK; host app sends its own eventRequires platform APIs and backend verification
ExplainabilityField-level and source-orientedPlatform-defined labels or verification result
Platform scopeOne cross-platform React Native event modelDifferent Android and Apple protocols
Trust propertyAttacker-influenced client observationPlatform-backed statement when correctly bound and verified
Offline inspectionYesGenerally not a complete production verification path

Recommended combined architecture

  1. Your backend creates a short-lived action ID.
  2. The app binds the platform attestation request to that action or a server challenge.
  3. The app collects a purpose-approved raw signal profile close to the same action.
  4. The app submits both through an authenticated endpoint.
  5. The backend verifies attestation independently and stores raw observations with distinct provenance.
  6. Policy combines verified platform state, account history, action context, raw observations, and recovery rules.
Never copy a platform verdict into the raw probe object. Keep source, verification state, errors, and timestamps explicit so downstream systems cannot confuse attested data with client observations.

Google Play Integrity

Play Integrity can provide app, account, device, and optional environment verdicts. The backend must verify request details and decode or verify the response using the documented Google flow. It can cover hardware-backed device integrity and optional Play ecosystem signals that a local library cannot reproduce.

Read Google's Play Integrity overview and verdict reference before implementation.

Apple App Attest and DeviceCheck

App Attest lets a backend verify assertions associated with a genuine app instance using Apple services and server-side challenge handling. DeviceCheck provides a separate Apple service for limited device-associated state. Neither is represented as a raw probe in this SDK.

Follow Apple's current App Attest and DeviceCheck documentation for key lifecycle, assertion verification, retry behavior, and unsupported environments.

What not to do

  • Do not treat client-side fields as attested claims.
  • Do not cache or replay an attestation result across unrelated actions.
  • Do not invent a single universal device trust boolean.
  • Do not persist a device identifier to join unrelated user activity.
  • Do not block from one observation without calibration and recovery.

The SDK does not calculate a risk score and does not perform network requests.