Quixxi App Attestation #

A Flutter plugin that provides real-time application integrity verification using the Quixxi App Attestation service.

Prerequisites #

Before integrating the plugin, you must:

1. Register at Quixxi Security: Log in to the Quixxi Security Portal.
2. Configure Your Application: Add your app to the portal to get your unique credentials.
3. Obtain Credentials: You will need the following values from the portal:
   • privateKey: Your unique private key for signing attestation requests.
   • appGuid: The unique identifier for your application.
   • baseUrl: The base URL of your app server.

Note: To ensure successful attestation across both platforms, you must use the same application identifier for Android (applicationId in build.gradle) and iOS (CFBundleIdentifier in Info.plist). The Quixxi Security Portal requires a single, consistent identifier for each app.

Installation #

Add this to your package's pubspec.yaml file:

dependencies:
  quixxi_app_attestation: ^0.0.1-beta.4

Then, run flutter pub get to install the plugin.

Usage #

It is crucial to invoke the attestation check as early as possible in your application’s lifecycle. The ideal place is in your main() function, before runApp().

Example #

Here's how to initialize and run the attestation check:

import 'package:flutter/material.dart';
import 'package:quixxi_app_attestation/quixxi_app_attestation.dart';

void main() async {
  // Ensure the Flutter binding is initialized.
  WidgetsFlutterBinding.ensureInitialized();

  // Run the app attestation check.
  final isAttestationSuccessful = await QuixxiAppAttestation.init(
    privateKey: 'YOUR_PRIVATE_KEY', // Replace with your key from the Quixxi portal
    baseUrl: 'YOUR_BASE_URL',       // Replace with your Base URL
    appGuid: 'YOUR_APP_GUID',       // Replace with your GUID from the Quixxi portal
  );

  if (isAttestationSuccessful) {
    // If attestation is successful, run the app normally.
    runApp(const MyApp());
  } else {
    // If attestation fails, you can take protective actions, such as:
    // 1. Showing an error screen.
    // 2. Disabling critical features.
    // 3. Exiting the application.
    runApp(const AttestationFailedScreen());
  }
}

class MyApp extends StatelessWidget {
  const MyApp({super.key});

  @override
  Widget build(BuildContext context) {
    return const MaterialApp(
      home: Scaffold(
        body: Center(child: Text('App Attestation Successful!')),
      ),
    );
  }
}

class AttestationFailedScreen extends StatelessWidget {
  const AttestationFailedScreen({super.key});

  @override
  Widget build(BuildContext context) {
    return const MaterialApp(
      home: Scaffold(
        body: Center(
          child: Text('Application integrity could not be verified. Please download the official app from the app store.'),
        ),
      ),
    );
  }
}

Parameters for init() #

Support #

• Dashboard & Configuration: Quixxi Security Portal
• Technical Support: support@quixxi.com