The Gate That Browsers Cannot Walk Through

As browser-based bot defense matured, mobile apps became the softer target—until the platforms themselves shipped attestation. Google and Apple now provide cryptographic APIs that let a server verify a request came from a genuine, unmodified app running on a genuine device. For anti-bot work, attestation is the hardest wall yet, because the proof is rooted in hardware and platform keys that a scraper cannot fabricate.

Google Play Integrity API

Android's Play Integrity API returns a signed verdict covering:

  • App integrity: whether the app binary is the one published by the developer, unmodified.
  • Device integrity: whether the device passes Android's compatibility and integrity checks (not rooted, bootloader locked, no emulator).
  • Account details: whether the request comes from a licensed install on a real Google account.

The app requests an integrity token from Google Play, receives a signed blob, and sends it to its own backend, which verifies the signature with Google's servers. A scraper replaying API calls without a fresh, valid token is rejected.

Apple App Attest and DeviceCheck

On iOS, App Attest uses the Secure Enclave to generate a hardware-backed key pair unique to the app installation. The server challenges the app, the app signs the challenge with its attested key, and the server verifies that the key was genuinely generated inside the secure hardware on a real device. DeviceCheck similarly produces a per-device token that apps can use to distinguish genuine devices and detect reinstall abuse.

Why Browsers Cannot Fake It

The entire security rests on secrets that never leave secure hardware—the Secure Enclave on iOS, the hardware-backed keystore and platform signing on Android. No JavaScript environment, emulator, or HTTP client can mint a valid attestation, because the signing key is not extractable. That is precisely the point: attestation moves trust from software (which can be patched) to hardware (which cannot, short of a physical or platform exploit).

Emulators, Root, and Detection

Attestation also detects the environments scrapers love: emulators, rooted devices, and modified system images all fail the device-integrity check. This means the classic "run the app in an emulator and intercept its traffic" workflow is often blocked outright. Attackers sometimes try to pass attestation by harvesting tokens from real devices (a token farm) or by exploiting platform bugs—both expensive and quickly patched, and both ethically and legally fraught.

Where This Leaves Scrapers

Attestation turns some targets into genuine walls. When a mobile API is protected by fresh, server-verified attestation, the honest options are:

  1. Use the platform's official API or data-licensing program.
  2. Find a legitimate web or partner channel that is not attestation-gated.
  3. Accept that the data is not meant to be scraped and choose a different source.

Teams sometimes operate real-device farms with legitimate accounts and genuine tokens to access their own data (for example, automating a service they subscribe to), which is a different and more defensible scenario than forging attestation to evade a platform's controls. Whatever the approach, treat attestation as a clear signal that the platform has drawn a deliberate line—and that crossing it carries real legal and ethical weight.