> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cdp.coinbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Onramp (App2App)

Onramp APIs used by partner mobile apps for the app-to-app handoff into the Coinbase retail app.

Both flows have the same shape: your backend mints a short-lived challenge with a CDP API key (`apiKeyAuth`), then the mobile app submits that challenge back with platform attestation and no API key.

**Device registration** runs once per app install, before the first handoff. Mint a challenge with `POST /v2/onramp/mobile/attestation/challenges`, then register the device key with `POST /v2/onramp/mobile/attestation/registrations`. iOS only; Android validates Play Integrity inline and has no registration step.

**Session handoff** runs once per onramp transaction. Mint a challenge with `POST /v2/onramp/mobile/sessions/challenges`, then exchange it for a ready-to-use onramp URL with `POST /v2/onramp/mobile/sessions`.

Never ship a CDP API key in the mobile app: mint the challenge on your backend and pass it to the device.

These APIs are consumed by the CDP React Native SDK.