iOS 27 extends App Attest with launch validation category and bundle version extensions in the authenticator data, plus macOS 27 support and a new ACL Blob OID in the leaf certificate — giving servers richer signals to detect tampered or misused app copies.
• New authenticator data extensions: launchValidationCategory and bundleVersion are now appended to attestation authenticator data on iOS 27+.
• macOS 27 gains App Attest support for the first time; leaf certificate now includes an ACL Blob OID representing Secure Enclave key access control conditions.
• isSupported API now correctly returns true for Action and SSO app extensions, previously unsupported categories.
• Receipt format additions align with new extension fields, requiring server-side receipt parsing updates.
• New authenticator data extensions (launch validation category + bundle version) let your server detect apps running in unexpected environments like TestFlight or with modified bundle versions — without any extra API calls.
• macOS 27 gains full App Attest support for the first time, with mandatory key access control (ACL Blob OID) properties proving System Integrity Protection and Full Security Mode were active at attestation time.
• The isSupported API now correctly gates App Attest across more extension types, and unsupported responses can themselves be used as a fraud signal in your risk model.
In-depth guide
iOS 26 → iOS 27 Migration Guide →