Security and Attestation Flow

To ensure the security of the execution environment and prevent fraudulent activities, the Tap on Phone application relies on an internal security attestation mechanism. Understanding how this process works helps you design a smoother, delay-free checkout experience for your merchants.

What is Attestation?

Before the Tap on Phone application can process a payment, it must prove to the backend that the Android device and its execution environment are secure and have not been tampered with.

To do this, the application performs a series of security checks. If the device passes these checks, the Tap on Phone backend issues an attestation token. This token serves as a proof of security and is strictly required for every transaction request.

The Automated Background Process

Because attestation tokens have a limited validity period, they must be renewed regularly.

The Tap on Phone app manages this renewal automatically:

• As soon as you successfully initialize the application, an automated background worker begins periodically renewing the attestation token.
• These checks run completely in the background without displaying any user interface.
• This automated process runs continuously and only stops if the POS session is explicitly reset.

The Potential UI Delay

While the automated process handles most scenarios, background workers on Android can occasionally fail or be killed by the operating system due to network loss, battery optimization, or unexpected crashes.

If the background attestation process fails and the current attestation token expires, the Tap on Phone app must perform a synchronous security check the next time you initiate a transaction.

The impact: When this happens, the Tap on Phone application might stall for a few seconds to process the attestation before displaying the payment UI to the merchant.

Proactive Attestation

To prevent this potential delay and ensure the payment UI appears instantly, your client application can proactively trigger a manual attestation using an Android Broadcast.

When you broadcast this request, the Tap on Phone app attempts to perform the attestation in the background immediately. If the current attestation is still valid, the app does nothing, ensuring no resources are wasted.

Recommended Trigger Points

To optimize the merchant experience, we recommend sending an attestation broadcast at key moments before the checkout flow reaches the payment stage. Good trigger points include:

• When your application is launched or brought to the foreground (e.g., in onStart or onResume), provided the POS is already initialized.
• When the merchant begins adding products to the shopping cart.
• When the merchant starts typing an amount on the keypad.

Triggering an Attestation

To manually trigger an attestation, send a broadcast to the Tap on Phone application using the ATTESTATION_BROADCAST action. You must include the userId and userToken for SSO validation.

val intent = Intent().apply {
    action = "com.dejamobile.cbp.sps.ATTESTATION_BROADCAST"
    component = ComponentName(
        "com.dejamobile.cbp.sps.app",
        "com.dejamobile.cbp.sps.app.broadcast.AttestationBroadcastReceiver"
    )
    addFlags(Intent.FLAG_INCLUDE_STOPPED_PACKAGES)

    // Mandatory SSO parameters
    putExtra("userId", userId)
    putExtra("userToken", userToken)

    // Optional: Define a custom response broadcast action
    putExtra("ResponseAction", "my.custom.broadcast.name.ATTESTATION_RESPONSE")
}

// Fire the broadcast
sendBroadcast(intent)

Handling the Response

The Tap on Phone app emits a response broadcast once the background attestation finishes. You can listen to this broadcast to verify the status.

Extract the Status boolean from the intent extras. If it returns false, you can optionally inspect the Error and ErrorMessage extras for troubleshooting.