Onramp APIs used by partner mobile apps for the app-to-app handoff into the Coinbase retail app.
Both flows have the same shape: your backend mints a short-lived challenge with a CDP API key (apiKeyAuth), then the mobile app submits that challenge back with platform attestation and no API key.
Device registration runs once per app install, before the first handoff. Mint a challenge with POST /v2/onramp/mobile/attestation/challenges, then register the device key with POST /v2/onramp/mobile/attestation/registrations. iOS only; Android validates Play Integrity inline and has no registration step.
Session handoff runs once per onramp transaction. Mint a challenge with POST /v2/onramp/mobile/sessions/challenges, then exchange it for a ready-to-use onramp URL with POST /v2/onramp/mobile/sessions.
Never ship a CDP API key in the mobile app: mint the challenge on your backend and pass it to the device.
These APIs are consumed by the CDP React Native SDK.
