Attest¶

Register this browser's signing key with DEA. The SDK creates the key the first time it is needed and keeps it in the browser's IndexedDB; the private half cannot be read by your page, by other scripts, or by the SDK itself. Signed proofs — see Ads — are signed with this key, and DEA accepts a proof only from a key it has registered.

Web attestation is key registration only. Browsers have no platform attestation like Play Integrity or App Attest. A passed verdict means DEA accepted the key; it says nothing about whether the device is genuine.

When to use it¶

Before you open an ad session: the SDK never registers the key by itself, and DEA refuses every proof signed by a key it has not registered
Before a sensitive step, to make sure the key is registered
To show attestation status in a diagnostics screen

Prerequisites¶

The SDK is installed and initialized with your appId and appKey. See the Quick Start and Accounts and keys.
The page is served over HTTPS or from localhost.
The browser allows IndexedDB. Some private-browsing modes do not.
Your Content Security Policy allows https://poh-api.dep-protocol.com in connect-src — see Content Security Policy.

Usage¶

Attest¶

import { DeaSdk } from '@dea/sdk';

const attestation = await DeaSdk.current?.attest();

switch (attestation?.verdict) {
  case 'passed':
    // DEA accepted this browser's key.
    break;
  case 'unsupported':
    // No key could be created: storage refused, or no Web Crypto.
    break;
  case 'failed':
    // DEA refused, could not be reached, or no appKey was set.
    break;
}

attest() never throws. It fetches a one-time challenge from DEA and sends back the key's public half with it, under your appKey. A passed result is kept until 60 seconds before expiresAt: calling attest() again before then answers at once, without a request. After that, the next call registers the key again; the SDK does not renew it by itself. A failed result is not kept, so the next call tries again.

On a production appId with no appKey, attest() answers 'failed' without making a request.

Examples¶

Attest before a payment step¶

import { DeaSdk } from '@dea/sdk';

async function openPayment() {
  const attestation = await DeaSdk.current?.attest();
  if (attestation?.verdict !== 'passed') {
    reportDiagnostic('attestation', attestation);
  }
  showPaymentForm();
}

reportDiagnostic and showPaymentForm stand for your own code.

API¶

Member	Returns	Description
`attest()`	`Promise<Attestation>`	Registers the key and returns the result

Attestation:

Field	Type	Description
`supported`	`boolean`	Whether a key could be created in this browser
`verdict`	`'passed' \\| 'failed' \\| 'unsupported'`	The outcome
`expiresAt`	`number \\| null`	When the registration expires, in epoch seconds
`kid`	`string \\| null`	The key's identifier
`tier`	`string \\| null`	The trust tier DEA assigned

Attest¶

When to use it¶

Prerequisites¶

Usage¶

Attest¶

Examples¶

Attest before a payment step¶

API¶

Related¶