Bots call your API directly and clear out the coupons. How do you use App Attest so the server accepts only requests from your real App Store app?
You create a Secure Enclave key, the server verifies the Apple-signed attestation and registers the public key, and every high-risk request after that carries an assertion signed with that key for the server to verify.
SecurityMultiple choiceAdvanced
Which statements about a key created with CryptoKit's…
#secure-enclave
SecurityShort answerAdvanced
Your app puts the token the server returned at login into the header of every request. An…
#app-attest
SecurityShort answerAdvanced
A security audit says card numbers, passwords, and PINs stay in process memory after…
#secure-enclave