Hi everyone, I would like to detail my experience with Singpass since 2022.
I originally installed Singpass through the Aurora store on owner profile and I did not enable Exploit protection Compatibility mode. Google Play Services was installed. Though I had to permit native code debugging and Webview JIT, and later on Dynamic code loading from memory/storage as well and all was fine for the last 2 years+
When Graphene started to show Play Integrity API usage, I tested it by blocking Singpass from using it and sure enough it breaks the app. I later allowed it and it works fine. I subsequently moved all my apps to the Google Play Store as it is more secure, including Singpass and it was working fine as well for at least 3 other users, all using Pixel 6a as well. Whereas others with the exact same configuration and even exploit protection compatibility mode enabled failed to register Singpass.
Recently with the Android 16 update(2025070800) I received the T13 error from Singpass which was resolved for most users who had Singpass working and installed beforehand when Singpass updated on 15th July 2025. This is possibly due to the login token being preserved. However for myself, I reinstalled the app and lost the configuration, as a result I am also facing the same 88-S15-EG-20 error and based on logcat I do not see any significant difference between devices that have Singpass working on GrapheneOS Android 16. Right now when I try to register the Singpass app, I will receive the SMS OTP but the app will not even attempt to verify that I actually keyed in the correct OTP when I submit it, GrapheneOS will indicate that Play Integrity API was used and the 88-S15-EG-20 error will appear at this point.
I don't really have an explanation on why the 88-S15-EG-20 error occurs in the first place other than it being linked to Play Integrity API, but then again it doesn't explain why it was working for me for more than 2 years and there are still users who have not experienced a single issue up to this point which probably means Singpass has a broken implementation of Play Integrity.
I have written to my MP which of course just referred it to the Singpass team with a standard template reply "To ensure consistent standards of security, reliability, and protection for all users across millions of devices, the Singpass app requires platform-level certifications - including Google Play Protect certification. Devices that do not meet these requirements, such as those running custom ROMs like GrapheneOS, are not supported.
Currently, there are no plans to support alternative operating systems that do not meet these established requirements. " "Alternatively, the Singpass app remains fully functional on supported Android and iOS devices that meet the necessary certification standards."
In anyways, I have already explained the hardening by GrapheneOS and how it meets and exceeds security requirements except passing strong integrity checks and that "by using the standard Android hardware attestation API instead and permitting our official release signing keys. Android's hardware attestation API provides a much stronger form of attestation than the Play Integrity API" from https://grapheneos.org/articles/attestation-compatibility-guide to the Singpass helpdesk and they didn't comment on it anyways. I also highlighted how anti-competitive Play Integrity API is.
My suggestion to anyone encountering the 88-S15-EG-20 is to write in to your MP about this and hopefully with enough "appeal letters" we can get Singpass to drop Play Integrity API entirely.