# Request an attestation challenge

> Issue a one-time, five-minute challenge that the Android SDK has the device keystore attest to, proving the report is fresh.

Last updated: 2026-09-17

```http
POST /api/v1/attestation/challenge
```

Authentication: Public key (`x-api-key: fly_pk_…`)

Issues a random challenge bound to your organization and SDK key. The [Android SDK](https://docs.fingerly.io/docs/sdks/android#hardware-backed-attestation) requests one before collecting, has the device's hardware keystore attest to it, and includes the attestation in its identify request. The server checks it and consumes the challenge, so an attestation cannot be replayed.

> **Note:** The Android SDK calls this endpoint automatically. See [mobile app attestation](https://docs.fingerly.io/docs/mobile-attestation).

The request has no body.

## Response

- `challenge` (string): 32 random bytes, base64-encoded.
- `expires_at` (string): When the challenge stops being accepted: five minutes after it was issued.

Each challenge can be used once. Challenges are free.

## Errors

| Status | Code | When |
| --- | --- | --- |
| `401` | `unauthorized` | The key did not authenticate. |
| `503` | `service_unavailable` | A challenge could not be issued just now. |

## Example request

```bash cURL
curl -X POST "https://us.api.fingerly.io/api/v1/attestation/challenge" \
  -H "x-api-key: fly_pk_us_production_…" \
  -H "x-fingerly-sdk-platform: android"
```

## Example response

```json 200
{
  "challenge": "q8Xv0bJ3c2Vj3kQm1s9Qe2Ww5rT7yU8iO1pA3sD5fG0=",
  "expires_at": "2026-09-16T09:46:12Z"
}
```