The web server refuses the request, and returns an HTTP 401 response with a PrivateToken challenge: HTTP/1.1 401 Unauthorized WWW-Authenticate: PrivateToken challenge=<base64 challenge data>, token-key=<base64 public-key> (Newlines added for readability) The browser recognizes this, and sends parts of the challenge, in addition to verified details of your device provided by the OS, to an attester (e.g. Apple). The attester verifies your device is real & unmodified (depends on the device, but both Android & iOS have existing ways to check this) and works with a token issuer (somebody trusted by the origin & that trusts the attester, e.g. Cloudflare/Fastly) to return a signed token, proving that your device has been verified as legitimate.