title: iOS AppAttestation getting invalidKey error when calling generateAssertion even after calling attestKey
body: <p>I am implementing app attestation for my iOS app. This is my flow:</p>
  <ol>
  <li>Registration</li>
  </ol>
  <ul>
  <li>Call <a href="https://developer.apple.com/documentation/devicecheck/dcappattestservice/3573913-generatekey?changes=latest_minor" rel="nofollow noreferrer"><code>generateKey() async throws -&gt; String</code></a></li>
  <li>Call <a href="https://developer.apple.com/documentation/devicecheck/dcappattestservice/3573911-attestkey?changes=latest_minor" rel="nofollow noreferrer"><code>attestKey(_ keyId: String, clientDataHash: Data) async throws -&gt; Data</code></a></li>
  <li>Register the key with our back-end</li>
  <li>Cache attestationKey and registrationKey</li>
  </ul>
  <ol start="2">
  <li>Signing</li>
  </ol>
  <ul>
  <li>Register if no cached keys else use the cached attestationKey and registrationKey</li>
  <li>Call <a href="https://developer.apple.com/documentation/devicecheck/dcappattestservice/3573912-generateassertion?changes=latest_minor" rel="nofollow noreferrer"><code>generateAssertion(_ keyId: String, clientDataHash: Data) async throws -&gt; Data</code></a></li>
  <li>Do more things...</li>
  </ul>
  <p>I noticed that <code>generateAssertion</code> does not throw any error for a few days after registration was successful. But then it starts throwing <a href="https://developer.apple.com/documentation/devicecheck/dcerror/code/invalidkey?changes=latest_minor" rel="nofollow noreferrer"><code>invalidKey</code></a> error for the same attestationKey.</p>
  <p>From the description of that error:</p>
  <blockquote>
  <p>You receive this error if something goes wrong with generating, retrieving, or using an App Attest cryptographic key, when:</p>
  <ul>
  <li>You call attestKey(_:clientDataHash:completionHandler:) for a key that’s already been attested.</li>
  <li>You call generateAssertion(_:clientDataHash:completionHandler:) with an unattested key.</li>
  <li>The App Attest service rejects the key.</li>
  </ul>
  </blockquote>
  <p>Based on my analysis so far, I have 2 question:</p>
  <ul>
  <li>I have already attested the key when I registered. Do I have to call attestKey again after a few days and re-register?</li>
  <li>Is it reason 3 and how will I know why app attest service rejects the key?</li>
  </ul>
  <hr />
  <p>Edit:</p>
  <p>Verified locally and I do not get this error when calling <code>generateAssertion</code> if I use a cached <code>attestationKey</code> and do not call <code>attestKey</code>.</p>
  <p>I wonder if Apple has a upper bound on how long an <code>attestKey</code> result remains valid. Is it a day? a week?</p>