# App/device attestation for backend requests from a webOS TV web app — any supported mechanism?

**URL:** <https://forum.webostv.developer.lge.com/t/app-device-attestation-for-backend-requests-from-a-webos-tv-web-app-any-supported-mechanism/28264>\
**Category:** Web App Development\
**Created:** [July 6, 2026, 12:08am UTC](https://forum.webostv.developer.lge.com/t/app-device-attestation-for-backend-requests-from-a-webos-tv-web-app-any-supported-mechanism/28264 "2026-07-06T00:08:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sportvibez](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@sportvibez](https://forum.webostv.developer.lge.com/u/sportvibez)\
**Post date:** [July 6, 2026, 12:08am UTC](https://forum.webostv.developer.lge.com/t/app-device-attestation-for-backend-requests-from-a-webos-tv-web-app-any-supported-mechanism/28264/1 "2026-07-06T00:08:31Z")

</div>

Hi,

Any App attestation mechanism I can use to call my backend?  
app signing exposed at runtime, hardware keys from DRM?, any client-cert support in the webview, or secrets baked in the IPK are extractable?

Is there any Luna API that returns a server-verifiable, LG-signed device/app token?

Or is server-side session verification the intended ceiling?

Thanks  
Sportvibez Team

---

<div class="post-metadata">

**Author:** ![narae0.kim](https://avatars.discourse-cdn.com/v4/letter/n/87869e/32.png) [@narae0.kim](https://forum.webostv.developer.lge.com/u/narae0.kim)\
**Post date:** [July 7, 2026, 8:19am UTC](https://forum.webostv.developer.lge.com/t/app-device-attestation-for-backend-requests-from-a-webos-tv-web-app-any-supported-mechanism/28264/2 "2026-07-07T08:19:35Z")

</div>

You can use [Device Unique ID API](https://webostv.developer.lge.com/develop/references/device-unique-id). LGUDID is generated using MAC as a seed. Thank you.

---

<div class="post-metadata">

**Author:** ![sportvibez](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@sportvibez](https://forum.webostv.developer.lge.com/u/sportvibez)\
**Post date:** [July 7, 2026, 7:55pm UTC](https://forum.webostv.developer.lge.com/t/app-device-attestation-for-backend-requests-from-a-webos-tv-web-app-any-supported-mechanism/28264/3 "2026-07-07T19:55:51Z")

</div>

So I can send the UUID from the TV when I call my backend servers, then I can verify this UUID server side by calling and verifying with luna://com.webos.service.sm? Did I get this correctly?

---

<div class="post-metadata">

**Author:** ![narae0.kim](https://avatars.discourse-cdn.com/v4/letter/n/87869e/32.png) [@narae0.kim](https://forum.webostv.developer.lge.com/u/narae0.kim)\
**Post date:** [July 7, 2026, 8:15pm UTC](https://forum.webostv.developer.lge.com/t/app-device-attestation-for-backend-requests-from-a-webos-tv-web-app-any-supported-mechanism/28264/4 "2026-07-07T20:15:44Z")

</div>

No, the Luna Service API is only avaliable in webOS TV apps. The Device Unique ID API is can be used for device identification/authentication, but it is up to you how to utilize the API in your app. Thank you.