On this page
Architecture guide
Raw signals and attestation solve different problems
Use platform-backed tokens when you need a server-verifiable platform statement. Use transparent raw observations when you need field-level context, diagnostics, or cross-platform consistency.
The core difference
Play Integrity and App Attest are remote verification protocols. Their useful security properties depend on challenge or request binding and server-side verification. React Native Device Risk Signals is a local observation library. It returns values your app can inspect and serialize, but those values remain attacker-influenced.
Choose the layer by the claim you need
| Capability | Raw device signals | Platform attestation |
|---|---|---|
| Output | Typed paths, properties, classes, libraries, runtime and device observations | Signed or server-decoded platform verdict or assertion |
| Transport | None in the SDK; host app sends its own event | Requires platform APIs and backend verification |
| Explainability | Field-level and source-oriented | Platform-defined labels or verification result |
| Platform scope | One cross-platform React Native event model | Different Android and Apple protocols |
| Trust property | Attacker-influenced client observation | Platform-backed statement when correctly bound and verified |
| Offline inspection | Yes | Generally not a complete production verification path |
Recommended combined architecture
- Your backend creates a short-lived action ID.
- The app binds the platform attestation request to that action or a server challenge.
- The app collects a purpose-approved raw signal profile close to the same action.
- The app submits both through an authenticated endpoint.
- The backend verifies attestation independently and stores raw observations with distinct provenance.
- Policy combines verified platform state, account history, action context, raw observations, and recovery rules.
Google Play Integrity
Play Integrity can provide app, account, device, and optional environment verdicts. The backend must verify request details and decode or verify the response using the documented Google flow. It can cover hardware-backed device integrity and optional Play ecosystem signals that a local library cannot reproduce.
Read Google's Play Integrity overview and verdict reference before implementation.
Apple App Attest and DeviceCheck
App Attest lets a backend verify assertions associated with a genuine app instance using Apple services and server-side challenge handling. DeviceCheck provides a separate Apple service for limited device-associated state. Neither is represented as a raw probe in this SDK.
Follow Apple's current App Attest and DeviceCheck documentation for key lifecycle, assertion verification, retry behavior, and unsupported environments.
What not to do
- Do not treat client-side fields as attested claims.
- Do not cache or replay an attestation result across unrelated actions.
- Do not invent a single universal device trust boolean.
- Do not persist a device identifier to join unrelated user activity.
- Do not block from one observation without calibration and recovery.
The SDK does not calculate a risk score and does not perform network requests.