Getting Started

Installation

You can use our AI-Assisted Setup to install the plugin. Add the Capgo skills to your AI tool using the following command:

npx skills add https://github.com/Cap-go/capgo-skills --skill capacitor-plugins

Then use the following prompt:

Use the `capacitor-plugins` skill from `Cap-go/capgo-skills` to install the `@capgo/capacitor-device-integrity` plugin in my project.

If you prefer Manual Setup, install the plugin by running the following commands and follow the platform-specific instructions below:

1. Install the package

   bun add @capgo/capacitor-device-integrity

2. Sync native projects

   bunx cap sync

3. Configure platform requirements

   • Android: set plugins.DeviceIntegrity.cloudProjectNumber for Play Integrity when you use attestation APIs.
   • iOS: enable the App Attest capability in Xcode for attestation APIs.

Quick start

import { DeviceIntegrity } from '@capgo/capacitor-device-integrity';

const result = await DeviceIntegrity.getCapabilities();
console.log(result);

Example: getWidevineFingerprint

import { DeviceIntegrity } from '@capgo/capacitor-device-integrity';

const capabilities = await DeviceIntegrity.getCapabilities();
if (capabilities.widevine.fingerprintAvailable) {
  const result = await DeviceIntegrity.getWidevineFingerprint();
  console.log(result);
}

Example: prepareAttestation

import { DeviceIntegrity } from '@capgo/capacitor-device-integrity';

const capabilities = await DeviceIntegrity.getCapabilities();
const attestationSupported =
  capabilities.appAttest.supported || capabilities.playIntegrity.supported;

if (attestationSupported) {
  const result = await DeviceIntegrity.prepareAttestation();
  console.log(result);
}

Common pitfalls

• Native sync: run npx cap sync after plugin upgrades.
• Source of truth: trust src/definitions.ts in the GitHub repo.

Why use this plugin

Use one API to collect integrity signals during sign-up, login, or high-risk actions:

• Probe support before calling native APIs (getCapabilities)
• Fingerprint Android devices with Widevine (getWidevineFingerprint)
• Register and assert with App Attest or Play Integrity (prepareAttestation, createAttestation, createAssertion)
• Request iOS DeviceCheck tokens (getDeviceCheckToken)

Client values are not trustworthy until your backend verifies tokens and enforces replay protection.

Usage

import { DeviceIntegrity } from '@capgo/capacitor-device-integrity';

const capabilities = await DeviceIntegrity.getCapabilities();
console.log(capabilities.platform, capabilities.playIntegrity.supported);

if (capabilities.widevine.fingerprintAvailable) {
  const widevine = await DeviceIntegrity.getWidevineFingerprint();
  console.log(widevine.fingerprint, widevine.securityLevel);
}

const attestationSupported =
  capabilities.appAttest.supported || capabilities.playIntegrity.supported;

if (attestationSupported) {
  try {
    const prepared = await DeviceIntegrity.prepareAttestation();

    const challengeResponse = await fetch(
      'https://api.example.com/integrity/registration-challenge',
    );
    if (!challengeResponse.ok) {
      throw new Error(`Challenge request failed with ${challengeResponse.status}`);
    }
    const challengeBody = await challengeResponse.json();
    if (typeof challengeBody.challenge !== 'string' || challengeBody.challenge.length === 0) {
      throw new Error('Backend response missing challenge');
    }
    const challenge = challengeBody.challenge;

    const registration = await DeviceIntegrity.createAttestation({
      keyId: prepared.keyId,
      challenge,
    });

    const payloadResponse = await fetch(
      'https://api.example.com/integrity/assertion-payload',
    );
    if (!payloadResponse.ok) {
      throw new Error(`Payload request failed with ${payloadResponse.status}`);
    }
    const payloadBody = await payloadResponse.json();
    if (typeof payloadBody.payload !== 'string' || payloadBody.payload.length === 0) {
      throw new Error('Backend response missing payload');
    }
    const payload = payloadBody.payload;

    const assertion = await DeviceIntegrity.createAssertion({
      keyId: prepared.keyId,
      payload,
    });

    console.log(registration.format, registration.token);
    console.log(assertion.format, assertion.token);
  } catch (error) {
    console.error('Attestation flow failed', error);
  }
}

if (capabilities.deviceCheck.supported) {
  const deviceCheck = await DeviceIntegrity.getDeviceCheckToken();
  console.log(deviceCheck.token);
}

Widevine options

getWidevineFingerprint() accepts optional fields:

Field	Type	Description
includeRawId	boolean	When true, includes base64 raw Widevine device ID (sensitive).
hashSalt	string	Salt for fingerprint. Android uses the app package name when omitted.

Backend requirement

• Verify App Attest and Play Integrity tokens on your server.
• Treat Widevine identifiers as sensitive and disclose use in your privacy policy.
• Do not use Widevine values for advertising or cross-app tracking.

Keep going from Getting Started

If you are using Getting Started to plan security and compliance, connect it with Using @capgo/capacitor-device-integrity for the native capability in Using @capgo/capacitor-device-integrity, @capgo/capacitor-app-attest for focused App Attest and Play Integrity flows, Encryption for the implementation detail in Encryption, Compliance for the implementation detail in Compliance, and Capgo Security for the product workflow in Capgo Security.