---
title: "Create App Attest challenge"
method: POST
path: "/users/@me/app-attest/challenge"
tags: ["Users"]
---

# Create App Attest challenge

`POST /users/@me/app-attest/challenge`

## Request

- Base URL: `https://web.fluxer.app/api/v1`
- URL: `https://web.fluxer.app/api/v1/users/@me/app-attest/challenge`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/fluxer/apis/fluxer-api/docs/users/@me/app-attest/challenge/post.ts> (a function with typed inputs; its response is checked against the schema)

Creates a single use challenge for the iOS app, valid for 5 minutes. Use purpose attest before registering a new App Attest key, and purpose assert before submitting an age range. Returns APP_ATTEST_NOT_AVAILABLE with status 404 when this instance does not accept App Attest. Returns FEATURE_NOT_AVAILABLE_SELF_HOSTED with status 403 on a self-hosted instance, and AGE_RANGE_NOT_NEEDED with status 403 when the request does not come from a region where a date of birth typed in is not enough for mature content.

## Request body

- AppAttestChallengeRequest
  - `purpose` 'attest' | 'assert', required: What the challenge will be used for

## Response `200`

Success

- AppAttestChallengeResponse
  - `challenge` string, required: Single use challenge, 32 bytes as unpadded base64url
  - `expires_at` string, date-time, required: When the challenge stops working

## Other responses

- `400`: Bad Request - The request was malformed or contained invalid data
- `401`: Unauthorized - Authentication is required or the token is invalid
- `403`: Forbidden - You do not have permission to perform this action
- `404`: Not Found - The requested resource was not found
- `429`: Too Many Requests - You are being rate limited
- `500`: Internal Server Error - An unexpected error occurred

## Changes

> 64 revisions in range; 2 not diffed.

- **2026-11-06** `d3bfc81d0955`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/fluxer/apis/fluxer-api/changes/users/@me/app-attest/challenge/post.md)

---

[API](https://skmtc.dev/fluxer/apis/fluxer-api.md) - [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fluxer/apis/fluxer-api/revisions/2092bc8b2edf?raw)