Authentication
Choose server API keys or issuer identity protected by Apple App Attest.
Trusted server backends
Server applications authenticate with an application API key:
Authorization: Bearer agw_...
X-End-User-ID: customer-123The optional end-user header selects the per-user limit identity. When absent, the API key itself is the identity. Only the key hash and display prefix are stored in D1.
iOS applications
Mobile authentication combines two proofs:
- An issuer token proves the signed-in user identity.
- Apple App Attest proves the request originates from an accepted application installation.
The client first requests a challenge and registers its App Attest key. Subsequent
token exchanges submit a fresh challenge and assertion. The gateway returns a
short-lived bearer token for proxy and /me requests.
Simulator development
A separately generated per-application development credential can replace App Attest in Simulator workflows, but never replaces the issuer token. Development access must be explicitly enabled in that application's authentication policy.
Do not ship development credentials
Store the development credential outside source control and only inject it into local development builds. Physical-device and distribution builds should use App Attest.