Trust no one - Introducing the Play Integrity API
summary
Play Integrity API verifies that backend requests come from honest apps and devices by returning an attestation with three signals: app integrity, device integrity and Play account trust; classic requests use a server-generated nonce while the low-latency standard request uses a hashed payload called request hash (limit ~500 bytes). Device verdicts report meet strong integrity or basic/null; default quota is 10,000 requests per day. Integration requires Play Console and service account roles, recent Play Store & SDK versions, and supports Play Console test accounts and a Play debug option for troubleshooting.
AI-written summary · about
chapters (14)
- 0:00Introduction and agenda
- 1:55What is Play Integrity API
- 4:05How Play Integrity works
- 6:34Classic vs standard requests
- 9:03Standard request setup
- 11:11Integrity verdict details
- 14:03Setting up the API
- 16:32Mobile app integration
- 18:19Standard request flow
- 21:35Analytics and testing
- 24:05Testing strategies
- 25:08Error handling
- 28:59SafetyNet Attestation deprecation
- 30:27Migration timeline
related talks
07mIntroducing Play Integrity API developer preview
14mDemystifying attestation
39mHow Play Integrity Stops Devices That Don't Exist
10mProtect your game's integrity on Google Play
20mKeeping Google Play Safe: Privacy, Security and SDKs
39mAndroid App Security Fundamentals
26mProtecting games and players by fighting abuse and piracy
26mWhat's new in Google Play