Two bits and a signature: what DeviceCheck and App Attest actually guarantee

Scope is the part that bites. The two-bit field belongs to the developer account, not to the app ^[2], so three apps shipped under one account contend for the same four states ^[1]. Four states is two independent booleans ^[3]. The two questions the write-up itself suggests, whether this device already claimed the new-user promo and whether it has been flagged for chargeback fraud, spend the whole budget [c2b]. A third persistent flag has to be remembered somewhere other than Apple ^[3].

Reaching those bits means a POST to one of three endpoints, `validate_device_token`, `query_two_bits` and `update_two_bits`, authenticated with an ES256 JWT signed by a `.p8` key that has DeviceCheck enabled in the developer portal ^[13][14]. Development traffic goes to `api.development.devicecheck.apple.com` rather than the production host ^[15]. `isSupported` returns false on the Simulator, so the path you can exercise on your laptop is the fallback, not the feature ^[12]. And the token from `generateToken` is meant to be used once: it stays valid long enough to retry the specific request it was minted for, which is a retry window and not a session credential ^[11].

App Attest's guarantee is about provenance rather than history. The private key is generated in the Secure Enclave and cannot be extracted ^[5], and the certificate chain Apple issues names your Team ID and Bundle ID ^[6]. A valid signature therefore narrows the caller to a build carrying your identifiers that still holds a key Apple was willing to vouch for. It says nothing about what that install did last month.

The two phases have different costs and different failure modes, and the post is blunt that conflating them is the common implementation error. Attestation runs once per key install, involves Apple's servers, and is relatively expensive [c8a]. Assertion runs on every request afterwards, is cheap, and does not involve Apple at all, because your server checks the signature against the public key it stored during attestation [c8b]. That check has to sit on the server: a modified client is not a witness to its own integrity ^[10].

Run both and the division of labour is legible. App Attest says the request is authentic, DeviceCheck remembers that this device already burned its free trial, and according to the write-up plenty of production apps do exactly that ^[17].