trustpincloud/attest-verifier repository overview

⁠TrustPin attestation verifier

Self-hosted verifier for TrustPin app attestation. Run it in your own infrastructure, next to your API: it proves that requests come from a genuine, unmodified build of your iOS or Android app on a real device, and issues short-lived tokens your API or gateway can check.

• Apple App Attest (iOS, iPadOS, macOS, tvOS, watchOS, visionOS)
• Android Key Attestation and Google Play Integrity
• Debug tokens for simulators, emulators and CI
• Short-lived ES256 tokens, optionally bound to the app's own session
• A JWKS and an OIDC discovery document for your API or gateway

TrustPin does not operate this service and never sees your traffic. App attestation is included on every TrustPin plan. Attestation proves where a request comes from; it is not runtime protection (RASP).