---
title: "Hardware Key Attestation"
description: "Verify the device's bootloader and integrity state through Android's hardware-backed Key Attestation, and protect your app's endpoints with it."
---
> For the complete documentation index, see [llms.txt](https://docs.doverunner.com/llms.txt).

**Add-on feature:** 
Hardware Key Attestation is an add-on that requires a separate plan or contract. To use it, contact the [Help Center](https://support.doverunner.com).


**Hardware Key Attestation** verifies the device's bootloader and integrity state through Android's hardware-backed Key Attestation. It protects the endpoints of your app that you specify as **Target URLs**, and applies a detection mode that you set per app.

Hardware Key Attestation is configured in two places:

| Where | What you set |
| :---- | :----------- |
| [Sealing wizard, Step 5](#enabling-it-when-sealing) (or a preset) | Turn attestation on or off for each sealing, and choose the Target URLs. |
| [App Configurations](#detection-mode-in-app-configurations) | Choose which detection cases are enforced for the app. |

## Requirements

- Sealing version **3.3.0.0 or higher**.
- Hardware Key Attestation is enabled for your account. Until it is, the option is not shown in the sealing wizard or in presets, and App Configurations shows that the feature is not enabled.

## Enabling It When Sealing

On **Step 5 — Advanced Detection** of the [sealing wizard](https://docs.doverunner.com/mobile-app-security/android/android-sealing-options/#step-5--advanced-detection):

| Option | Values | Default | Description |
| :----- | :----- | :------ | :---------- |
| **Hardware Key Attestation** | Enable / Disable | Disable | Turns attestation on for this sealing. |
| **Target URLs** | URLs | — | Shown when attestation is enabled. The endpoints of your app that attestation protects — an exact URL or a regular expression, up to 50 URLs of 500 characters each. |

Whenever attestation is enabled, the detection mode set in App Configurations is applied automatically.

## Detection Mode in App Configurations

Open **Android Mobile App Security → App Configuration**, select the app, and go to the **Hardware Key Attestation** section. There is no on/off switch here — attestation is turned on or off per sealing, as described above.

| Detection mode | Behavior |
| :------------- | :------- |
| **Basic** | Detects only the three definitive cases — unlocked bootloader, Verified Boot failure, and app signature mismatch. The other four cases are allowed, to avoid false positives on older OS versions, LineageOS, and certain device manufacturers. |
| **Custom** | You turn each case on individually. Cases you leave unchecked are allowed. |

| Detection case | Badge | Action when detected |
| :------------- | :---- | :------------------- |
| **Unlocked bootloader detection** | Definitive | Deny |
| **Verified Boot failure detection** | Definitive | Deny |
| **App signature mismatch detection** | Definitive | Deny |
| **Revoked certificate detection** | Recommended | Limit |
| **Software-level attestation detection** | False-Positive Risk | Limit |
| **Attestation data absent detection** | False-Positive Risk | Limit |
| **Root certificate verification failure detection** | False-Positive Risk | Limit |

Click **Save** to store the detection mode.

**Tip:** 
Start with **Basic**. The cases marked **False-Positive Risk** can flag legitimate devices, so enable them in **Custom** mode only after you have checked their effect on your user base.


## Using It with the CLI Tool

The CLI tool has no options for Hardware Key Attestation. To apply it when you seal through the CLI, use a [sealing preset](https://docs.doverunner.com/mobile-app-security/android/android-preset/):


1. Set the detection mode for the app in App Configurations, as described above.
2. Open **Android → Preset** and create or edit a preset with sealing version 3.3.0.0 or higher.
3. In **Advanced Features**, enable **Hardware Key Attestation** and add the Target URLs, then save the preset.
4. Seal with the preset name:

   ```bash
   $ java -jar sealing.jar -url https://api.appsealing.com/covault/gw -authkey 123456789ABCDE -srcapk app-release.aab -sealedapk app-release-sealed.aab -sealing_preset_name my-preset-name
   ```


See [Using a Preset with the CLI Tool](https://docs.doverunner.com/mobile-app-security/android/android-preset/#using-a-preset-with-the-cli-tool) for the preset naming rules and the related warnings.