Infra

Platform Integrity APIs and Account Detection: How Devs Build Trust Verification Systems

Platform integrity APIs like Google Play Integrity and Apple DeviceCheck let social media apps verify whether an account is running on genuine hardware or an emulated, rooted, or tampered device before granting full platform access.

platform-integrityplay-integritydevicecheckattestationintegrity-api

Platform integrity APIs are the server-side gatekeepers that social media apps use to verify whether your account is running on a real device or an emulated, tampered, or compromised environment. Google Play Integrity on Android and Apple DeviceCheck on iOS provide cryptographically signed attestations about your device's hardware, OS status, and boot chain that apps can verify server-side before granting access to features, accounts, or APIs. An emulator or cloud phone that cannot produce a valid hardware-backed attestation token is blocked at the API level — before it ever reaches the app's content moderation layer.

How Google Play Integrity API Verifies Android Device Authenticity

Play Integrity operates through a three-tier verification system. The first tier, BASIC integrity, confirms the device is not rooted and the app package is unmodified — this is the easiest tier to spoof. The second tier, DEVICE_INTEGRITY, verifies the app is running on a genuine Android device with Google Play Services and an unmodified OS image. The third tier, STRONG integrity, requires hardware-backed key attestation through the device's Trusted Execution Environment (TEE) — a cryptographic proof that only physical smartphone hardware can produce.

A real Samsung phone running stock One UI passes all three tiers. An Android emulator running on a server passes none. A cloud phone service may spoof BASIC integrity but cannot produce the hardware-backed cryptographic signature required for STRONG integrity. Social media apps increasingly require STRONG integrity for sensitive operations like account creation, login, and content posting on new accounts. According to Google's Play Integrity documentation, the API processes over 500 billion attestation requests per day across Android apps, making it one of the most widely deployed trust verification layers in mobile computing (source).

How Apple DeviceCheck Persists Device Identifiers Across App Lifecycles

Apple's DeviceCheck API provides two persistent bits of per-device data that survive app uninstalls, device wipes, and OS updates. Apps associate these bits with device-level metadata — such as whether the device has previously been flagged for spam or linked to banned accounts. Because the tokens are per-developer and cannot be reset by the user, they create a device-based reputation system that follows the hardware regardless of account churn.

For distribution operations, DeviceCheck means an iOS device that has been flagged by TikTok or Instagram carries a permanent negative signal. Creating a new account on that same device will inherit the previous account's negative device reputation. The only way to reset is to use a device that has never been flagged — which is why real, clean hardware is foundational to sustainable distribution.

How Platform Integrity APIs Feed Into Trust Scoring

Integrity API results are one of the strongest inputs into a platform's account trust score. A device that passes STRONG integrity with a valid hardware attestation token and a genuine device fingerprint receives a high initial trust score. A device that passes only BASIC integrity — or fails entirely — receives a low initial trust score with limited account capabilities, higher enforcement sensitivity, and reduced reach. Imperva's analysis of automated platform abuse found that integrity-check failures are correlated with a 90%+ ban rate for accounts that attempt to interact with platform APIs at distribution scale (source).

How Conbersa Ensures Every Account Passes Platform Integrity Verification

Conbersa runs distribution on real, physical Android and iOS smartphones — each with a valid Play Integrity or DeviceCheck attestation that matches the physical hardware. Every device boots from an unmodified OEM firmware image with a locked bootloader. Google Play Services runs on the bare metal, not inside a virtualized layer. When a platform queries the device's integrity status, it receives the same response that any genuine user's personal smartphone would return — because Conbersa's devices are genuine smartphones operated by Conbersa's AI distribution agents.

Neil Ruaro
Founder, Conbersa

We run agentic distribution on a fleet of real phones — and write up what we learn helping founders escape the cold start. Got a topic you want covered? Tell us.

FAQ

Frequently asked questions

Google Play Integrity API is a server-side verification system that apps use to check whether they are running on a genuine Android device with an unmodified OS. It returns a verdict — DEVICE_INTEGRITY for real hardware, VIRTUAL_DEVICE for emulators — that platforms use to gate account creation and feature access.
Most emulators and cloud phone services fail Play Integrity DEVICE_INTEGRITY checks because they run on virtualized hardware without hardware-backed attestation. Even emulators that spoof BASIC integrity cannot pass STRONG integrity, which requires a hardware security module (TEE) that only physical devices provide.
Apple DeviceCheck assigns each iOS device a persistent, per-developer token that survives app uninstalls and device wipes. Social media apps use these tokens to track whether a device has previously been associated with banned accounts — making device-level bans nearly impossible to bypass on iOS.
The Conbersa Blog

New guides, straight to your inbox.

Tactics on organic distribution and the cold-start problem. What's actually working, no fluff.