Laravel Expo Integrity Laravel Package

Product Decisions This Supports

• Securing mobile API surface area: This package supports decisions around hardening Laravel backends that serve an Expo (React Native) app — verifying that API requests originate from your genuine, unmodified app binary rather than scripts, emulators, repackaged clones, or bots.
• Build vs. buy for app attestation: Rather than building in-house Play Integrity (Android) and App Attest/DeviceCheck (iOS) verification, token validation, nonce/replay handling, and Laravel middleware wiring, this package lets the team buy that plumbing and focus engineering on product features.
• Gating sensitive or monetized flows: Informs roadmap decisions on which endpoints (auth, payments, entitlement checks, promo/redemption, referral abuse prevention) should require integrity verification before launch.
• Anti-fraud and abuse-mitigation roadmap: Provides a concrete lever for abuse-prevention initiatives that otherwise compete for security engineering time.
• Release hygiene / dependency policy: The 1.0.1 patch only removes the v prefix from release tags and prepares the 1.0.1 tag — a packaging/CI convention change with no API, behavioral, or configuration impact. It signals an actively maintained project with semver discipline, which supports adopting it under normal patch-upgrade rules.

When to Consider This Package

Adopt when:

• You ship an Expo-managed (or bare React Native with Expo modules) mobile app backed by a Laravel API and need server-side proof that requests come from your real app.
• You have abuse-prone endpoints (auth, payments, entitlements, promotions) and want verification as Laravel middleware rather than bespoke per-project code.
• Your team is PHP/Laravel-centric and would rather not maintain Expo/Google/Apple attestation verification logic in-house.
• You need a low-friction, semver-tagged dependency with a small surface area; 1.0.1 confirms stable 1.x line and standard tagging.

Look elsewhere / proceed cautiously when:

• Your backend is not Laravel/PHP, or your client is not Expo/React Native — off-the-shelf attestation SDKs (Google Play Integrity, Apple App Attest) or platform-native solutions fit better.
• You need attestation as a hard security boundary without defense-in-depth: integrity checks are one layer and must be combined with rate limiting, auth, and server-side business rules.
• You require a large, mature ecosystem with extensive third-party audits; verify the repo's maintenance cadence, test coverage, and issue responsiveness before committing to production.
• Regulatory or compliance regimes mandate vendor-certified security components rather than community packages.

How to Pitch It (Stakeholders)

For executives (one paragraph): Our mobile app talks to a Laravel backend, and today nothing technically proves a request came from our real app rather than a script, a clone, or a bot. This small open-source package adds that proof at the API layer using the official Google and Apple app-integrity signals, closing a meaningful abuse and fraud gap without a custom build. The latest release (1.0.1) is a routine patch — it only standardizes how version tags are named — so there is no functional or migration impact; it simply confirms the project follows normal semantic-versioning discipline.

For engineering: This is a Composer package providing server-side verification of Expo app-integrity tokens (Play Integrity on Android, App Attest/DeviceCheck on iOS) with Laravel-idiomatic integration (config + middleware). 1.0.1 is a non-breaking patch: it removes the v prefix from release tags ahead of the 1.0.1 tag — no code, config, or API changes. Recommendation: adopt on the 1.x line, integrate verification as middleware on high-risk endpoints first, pair it with existing rate limiting and authorization, and validate coverage (test suite, issue activity, maintainer responsiveness) as part of the spike before broad rollout.