API reference

Request an attestation challenge

Issue a one-time, five-minute challenge that the Android SDK has the device keystore attest to, proving the report is fresh.

POST/api/v1/attestation/challenge Public key

Issues a random challenge bound to your organization and SDK key. The Android SDK requests one before collecting, has the device's hardware keystore attest to it, and includes the attestation in its identify request. The server checks it and consumes the challenge, so an attestation cannot be replayed.

The request has no body.

Response

challengestring
32 random bytes, base64-encoded.
expires_atstring
When the challenge stops being accepted: five minutes after it was issued.

Each challenge can be used once. Challenges are free.

Errors

Status	Code	When
`401`	`unauthorized`	The key did not authenticate.
`503`	`service_unavailable`	A challenge could not be issued just now.

Request

cURL

curl -X POST "https://us.api.fingerly.io/api/v1/attestation/challenge" \
  -H "x-api-key: fly_pk_us_production_…" \
  -H "x-fingerly-sdk-platform: android"

Response

200

{
  "challenge": "q8Xv0bJ3c2Vj3kQm1s9Qe2Ww5rT7yU8iO1pA3sD5fG0=",
  "expires_at": "2026-09-16T09:46:12Z"
}