Skip to content

App Attestation

App attestation is a security feature that enables Mobile Development Kit applications to prove their authenticity to backend services, helping protect against app tampering, cloning, and running on compromised devices.

The Mobile Development Kit integrates with platform-native attestation frameworks via the SAP BTP SDK for iOS and SAP BTP SDK for Android. SAP Mobile Services acts as the verification layer between the client and the platform attestation service.

  • iOS: Apple's App Attest framework (via SAP BTP SDK for iOS v9.1 or later)
  • Android: Google's Play Integrity API (via SAP BTP SDK for Android 5.1 or later)

When attestation is enabled, the client generates an attestation token and attaches it to requests. SAP Mobile Services validates these tokens to confirm that requests originate from a legitimate, unmodified app instance on an authentic device.

Prerequisites

Before configuring attestation in your Mobile Development Kit project, an administrator must enable and configure the Attestation feature in the mobile services cockpit.

Configuration

Configure app attestation in your MDKProject.json file using the Attestation property. The create-client tool processes this configuration and automatically applies the required changes to platform-specific files.

"Attestation": {
  "iOS": {
    "Environment": "development",
    "DebugToken": "your-ios-debug-token-here"
  },
  "Android": {
    "DebugToken": "your-android-debug-token-here"
  }
}

All properties are optional. Platform files are only created or updated when values are provided.

iOS Configuration

Property Type Default Description
Environment String "development" App Attest environment. Accepted values: "development" or "production". Use "development" for local builds and testing; use "production" for TestFlight and App Store distribution.
DebugToken String "" Debug token for testing attestation on platforms where App Attest is not fully supported, such as simulators.

The create-client tool applies the iOS configuration as follows:

  • Environment — written to App_Resources/iOS/<AppName>.entitlements as the com.apple.developer.devicecheck.appattest-environment key.
  • DebugToken — written to App_Resources/iOS/AppParameters.plist as the App Attest Debug Token key.

Note

The Environment value in MDKProject.json must match the App Attest entitlement in app.entitlements. A mismatch — for example, "production" in the entitlement but "development" in MDKProject.json — causes all attestation calls to fail.

Android Configuration

Property Type Default Description
DebugToken String "" Debug token for testing attestation during development.

The create-client tool applies the Android configuration as follows:

  • DebugToken — written to App_Resources_Merge/Android/src/main/res/values/strings.xml as the mdk_attestation_debug_token string resource.

Enforcement

Once attestation is enabled in mobile services cockpit, you can also enforce it. When attestation is enforced, SAP Mobile Services rejects any request that does not include a valid attestation token.

SAP Mobile Services issues an attestation token once the client passes validation. The token remains valid for the lifetime configured in mobile services cockpit. Within that period, the client does not need to re-attest on every request. The minimum token lifetime is 30 minutes; the maximum is 7 days.

Caution

Enable enforcement with caution. If your mobile services application is used by apps built with an SDK version that does not support attestation, those requests are rejected when enforcement is active. In that case, SAP recommends deploying a separate mobile services application for attestation-enabled apps.

To configure enforcement, see Configuring iOS Attestation and Configuring Android Attestation.

Debug Tokens

Note

Debug token values are generated in mobile services cockpit. Navigate to the Attestation tab of your application settings, enable attestation, and select Generate under the Debug Token field. For details, see Configuring iOS Attestation and Configuring Android Attestation.

Debug tokens allow you to test attestation-enabled apps in environments where the attestation framework is not fully supported, such as iOS Simulator or development Android devices. When a debug token is present in a request, the attestation check in SAP Mobile Services is skipped.

Note

Using a debug token on iOS requires an additional Xcode configuration. For details, see the Debug Token section in the iOS App Attestation topic in the SAP BTP SDK for iOS documentation.

Warning

Debug tokens must never be used in production builds. Remove or leave the DebugToken property empty before distributing your app. Treat debug tokens as development credentials — do not commit them to source control. Store them in CI secrets or environment files instead.

Platform Requirements

Platform Framework Minimum Version
iOS Apple App Attest iOS 14.0
Android Google Play Integrity API API level 19 (Android 4.4)
Last update: June 23, 2026