DeviceCheck and App Attest: Stopping Fraud in iOS Apps

Your API has no idea what is calling it. A request arriving at POST /api/redeem looks identical...