# ai.newnal.illi.account.getAttestationNonce

> Published by [illi-service.newnal.id](https://lexicon.garden/identity/did:plc:uztm7bi2ce42dez3uu3qafro)

✓ This is the authoritative definition for this NSID.

## Links

- [View on Lexicon Garden](https://lexicon.garden/lexicon/did:plc:uztm7bi2ce42dez3uu3qafro/ai.newnal.illi.account.getAttestationNonce)
- [Documentation](https://lexicon.garden/lexicon/did:plc:uztm7bi2ce42dez3uu3qafro/ai.newnal.illi.account.getAttestationNonce/docs)
- [Examples](https://lexicon.garden/lexicon/did:plc:uztm7bi2ce42dez3uu3qafro/ai.newnal.illi.account.getAttestationNonce/examples)

## Definitions

### `ai.newnal.illi.account.getAttestationNonce`

**Type**: `procedure`

Issue a server nonce (5 minutes) that a client binds into its attestation before calling account.requestPDNCreationGrant, account.parent.signIn, account.family.signIn or device.requestOnboardingCode. The nonce is an attestation session: the attestation bound to it may be presented again for the same client kind and subject until it expires; a failed verification ends the session. Devices put it in the Android key-attestation challenge of a key provisioned through Newnal's RKP; family apps pass it to Play Integrity or App Attest. No session required.

#### Input

**Encoding**: `application/json`

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `client` | `string` | Yes |  |
| `deviceId` | `string` | No |  |

#### Output

**Encoding**: `application/json`

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `expiresAt` | `string` (datetime) | Yes |  |
| `nonce` | `string` | Yes | base64url, 32 random bytes |

#### Errors

- **RateLimitExceeded**

## Raw Schema

```json
{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "Issue a server nonce (5 minutes) that a client binds into its attestation before calling account.requestPDNCreationGrant, account.parent.signIn, account.family.signIn or device.requestOnboardingCode. The nonce is an attestation session: the attestation bound to it may be presented again for the same client kind and subject until it expires; a failed verification ends the session. Devices put it in the Android key-attestation challenge of a key provisioned through Newnal's RKP; family apps pass it to Play Integrity or App Attest. No session required.",
      "errors": [
        {
          "name": "RateLimitExceeded"
        }
      ],
      "input": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "client": {
              "knownValues": [
                "device",
                "familyApp"
              ],
              "type": "string"
            },
            "deviceId": {
              "maxLength": 64,
              "type": "string"
            }
          },
          "required": [
            "client"
          ],
          "type": "object"
        }
      },
      "output": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "expiresAt": {
              "format": "datetime",
              "type": "string"
            },
            "nonce": {
              "description": "base64url, 32 random bytes",
              "type": "string"
            }
          },
          "required": [
            "nonce",
            "expiresAt"
          ],
          "type": "object"
        }
      },
      "type": "procedure"
    }
  },
  "id": "ai.newnal.illi.account.getAttestationNonce",
  "lexicon": 1
}
```