---
title: "Register this signed-in iPhone's App Attest key"
method: POST
path: "/v1/account/agent-location/app-attest/keys"
tags: ["Customer Account"]
---

# Register this signed-in iPhone's App Attest key

`POST /v1/account/agent-location/app-attest/keys`

## Request

- Base URL: `https://loppee.com`
- URL: `https://loppee.com/v1/account/agent-location/app-attest/keys`
- Auth: HTTP bearer

Verifies Apple's attestation for the allowlisted Loppee iPhone app and atomically binds the key to the authenticated customer and exact registered installation. Browser, desktop, agent-key, and extensionless requests outside the explicit release policy are rejected.

## Headers

- `X-Loppee-Client-Platform` string, required
- `X-Loppee-Installation-Id` string, required

## Request body

- object
  - `challenge_id` string, uuid, required
  - `challenge` string, required
  - `installation_id` string, uuid, required
  - `key_id` string, required
  - `attestation` string, required

## Response `200`

Register this signed-in iPhone's App Attest key response

- object
  - `status` 'registered', required
  - `environment` 'production' | 'development', required
  - `app_attest_registered` true, required

## Other responses

- `400`: ErrorResponse
- `401`: ErrorResponse
- `403`: ErrorResponse
- `404`: ErrorResponse
- `409`: ErrorResponse
- `413`: ErrorResponse
- `429`: RateLimitError
- `default`: ErrorResponse

---

[API](https://skmtc.dev/loppee/apis/loppee-business-registry-api-for-external-agents.md) · [All operations](https://skmtc.dev/loppee/apis/loppee-business-registry-api-for-external-agents/llms.txt) · [OpenAPI document](https://skmtc.dev/loppee/apis/loppee-business-registry-api-for-external-agents/revisions/37285f7cddcd?raw)