curl --request POST \
  --url https://api.cdp.coinbase.com/platform/v2/onramp/mobile/attestation/registrations \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "challenge": "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=",
  "ios": {
    "keyId": "abc123def456",
    "attestation": "b2F1dGhEYXRhQUFDSmdhVWRpY0FBQ1VqZw==",
    "bundleId": "com.coinbase.cdp-onramp"
  }
}
'

import requests

url = "https://api.cdp.coinbase.com/platform/v2/onramp/mobile/attestation/registrations"

payload = {
    "challenge": "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=",
    "ios": {
        "keyId": "abc123def456",
        "attestation": "b2F1dGhEYXRhQUFDSmdhVWRpY0FBQ1VqZw==",
        "bundleId": "com.coinbase.cdp-onramp"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    challenge: 'YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=',
    ios: {
      keyId: 'abc123def456',
      attestation: 'b2F1dGhEYXRhQUFDSmdhVWRpY0FBQ1VqZw==',
      bundleId: 'com.coinbase.cdp-onramp'
    }
  })
};

fetch('https://api.cdp.coinbase.com/platform/v2/onramp/mobile/attestation/registrations', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.cdp.coinbase.com/platform/v2/onramp/mobile/attestation/registrations",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'challenge' => 'YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=',
    'ios' => [
        'keyId' => 'abc123def456',
        'attestation' => 'b2F1dGhEYXRhQUFDSmdhVWRpY0FBQ1VqZw==',
        'bundleId' => 'com.coinbase.cdp-onramp'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.cdp.coinbase.com/platform/v2/onramp/mobile/attestation/registrations"

	payload := strings.NewReader("{\n  \"challenge\": \"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=\",\n  \"ios\": {\n    \"keyId\": \"abc123def456\",\n    \"attestation\": \"b2F1dGhEYXRhQUFDSmdhVWRpY0FBQ1VqZw==\",\n    \"bundleId\": \"com.coinbase.cdp-onramp\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.cdp.coinbase.com/platform/v2/onramp/mobile/attestation/registrations")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"challenge\": \"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=\",\n  \"ios\": {\n    \"keyId\": \"abc123def456\",\n    \"attestation\": \"b2F1dGhEYXRhQUFDSmdhVWRpY0FBQ1VqZw==\",\n    \"bundleId\": \"com.coinbase.cdp-onramp\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.cdp.coinbase.com/platform/v2/onramp/mobile/attestation/registrations")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"challenge\": \"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=\",\n  \"ios\": {\n    \"keyId\": \"abc123def456\",\n    \"attestation\": \"b2F1dGhEYXRhQUFDSmdhVWRpY0FBQ1VqZw==\",\n    \"bundleId\": \"com.coinbase.cdp-onramp\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "keyId": "abc123def456",
  "platform": "ios",
  "appId": "ABCDE12345.com.example.myapp",
  "attestedAt": "2026-02-03T10:30:00Z"
}

Onramp (App2App)

Register a device key for iOS App Attest

Verifies an iOS App Attest attestation payload and registers the device’s public key for future assertion validation. The server checks that the attestation is genuine and signed by Apple, that the bundle ID is in the partner’s allowed mobile clients list, and that the challenge issued by Create Onramp iOS Attestation Challenge is fresh and unused.

This is a one-time, per-device-install operation; iOS-only (Android validates Play Integrity inline per request and has no registration step). For security, all client-side verification failures are returned as an opaque 400 invalid_request — the response never reveals which specific check failed.

The Apple App Attest keyId is supplied only in the request body (ios.keyId). Do not put keyId in the URL — App Attest key IDs are standard base64 and frequently contain /, which breaks path routing at the edge.

Idempotency is provided by ios.keyId itself: the server upserts the device public key on (app, keyId), so repeating registration for the same key replaces the stored public key rather than creating a duplicate. This endpoint does not accept X-Idempotency-Key — ios.keyId is the natural idempotency key for the registration resource. The challenge remains single-use and is claimed on first receipt. The challenge identifies the project; the device does not supply a CDP project ID.

POST

onramp

mobile

attestation

registrations

curl --request POST \
  --url https://api.cdp.coinbase.com/platform/v2/onramp/mobile/attestation/registrations \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "challenge": "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=",
  "ios": {
    "keyId": "abc123def456",
    "attestation": "b2F1dGhEYXRhQUFDSmdhVWRpY0FBQ1VqZw==",
    "bundleId": "com.coinbase.cdp-onramp"
  }
}
'

import requests

url = "https://api.cdp.coinbase.com/platform/v2/onramp/mobile/attestation/registrations"

payload = {
    "challenge": "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=",
    "ios": {
        "keyId": "abc123def456",
        "attestation": "b2F1dGhEYXRhQUFDSmdhVWRpY0FBQ1VqZw==",
        "bundleId": "com.coinbase.cdp-onramp"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    challenge: 'YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=',
    ios: {
      keyId: 'abc123def456',
      attestation: 'b2F1dGhEYXRhQUFDSmdhVWRpY0FBQ1VqZw==',
      bundleId: 'com.coinbase.cdp-onramp'
    }
  })
};

fetch('https://api.cdp.coinbase.com/platform/v2/onramp/mobile/attestation/registrations', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.cdp.coinbase.com/platform/v2/onramp/mobile/attestation/registrations",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'challenge' => 'YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=',
    'ios' => [
        'keyId' => 'abc123def456',
        'attestation' => 'b2F1dGhEYXRhQUFDSmdhVWRpY0FBQ1VqZw==',
        'bundleId' => 'com.coinbase.cdp-onramp'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.cdp.coinbase.com/platform/v2/onramp/mobile/attestation/registrations"

	payload := strings.NewReader("{\n  \"challenge\": \"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=\",\n  \"ios\": {\n    \"keyId\": \"abc123def456\",\n    \"attestation\": \"b2F1dGhEYXRhQUFDSmdhVWRpY0FBQ1VqZw==\",\n    \"bundleId\": \"com.coinbase.cdp-onramp\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.cdp.coinbase.com/platform/v2/onramp/mobile/attestation/registrations")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"challenge\": \"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=\",\n  \"ios\": {\n    \"keyId\": \"abc123def456\",\n    \"attestation\": \"b2F1dGhEYXRhQUFDSmdhVWRpY0FBQ1VqZw==\",\n    \"bundleId\": \"com.coinbase.cdp-onramp\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.cdp.coinbase.com/platform/v2/onramp/mobile/attestation/registrations")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"challenge\": \"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=\",\n  \"ios\": {\n    \"keyId\": \"abc123def456\",\n    \"attestation\": \"b2F1dGhEYXRhQUFDSmdhVWRpY0FBQ1VqZw==\",\n    \"bundleId\": \"com.coinbase.cdp-onramp\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "keyId": "abc123def456",
  "platform": "ios",
  "appId": "ABCDE12345.com.example.myapp",
  "attestedAt": "2026-02-03T10:30:00Z"
}

Body

application/json

Request to register device public key for iOS App Attest attestation. This endpoint is iOS-only. Android devices use Play Integrity Standard API tokens sent directly in request headers instead.

challenge

string

required

The challenge received from the challenge endpoint.

Pattern: ^[A-Za-z0-9+/]+=*$

Example:

"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY="

ios

object

required

iOS App Attest payload for verification.

Show child attributes

Example:

{
  "keyId": "abc123def456",
  "attestation": "b2F1dGhEYXRhQUFDSmdhVWRpY0FBQ1VqZw==",
  "bundleId": "com.example.myapp"
}

Response

Attestation verified successfully. Device public key registered for assertion validation.

Response confirming successful attestation verification and device key registration. The device public key is now stored for validating future assertion signatures.

keyId

string

required

The key identifier that was registered. Include this value in subsequent Create Onramp Mobile Session requests as ios.keyId.

Example:

"abc123def456"

platform

enum<string>

required

The mobile platform that was attested (iOS only).

Available options:

ios

Example:

"ios"

appId

string

required

The verified Apple application identifier in teamID.bundleID format. This is not a CDP project ID.

Example:

"ABCDE12345.com.example.myapp"

attestedAt

string<date-time>

required

Timestamp when the attestation was performed.

Example:

"2026-02-03T10:30:00Z"

CDP API

REST API

Register a device key for iOS App Attest

Body

Response