Play Integrity API

Security Senior Kotlin 2.0+ API 24+ Reviewed 31 Oct 2026 By Best Latest Apps

Order the steps

Order a Play Integrity check for a high-value action.

App requests an integrity token with that nonce
App sends the token with its request to your server
Server allows, challenges or blocks the action
Server has Google decode the token and checks the verdict and nonce
Server creates a nonce for the action

Choose an answer, then open Show answer below to check it.

Show answer

Answer: E A B D C

Server creates a nonce for the action Ties the token to this request.
App requests an integrity token with that nonce From the Play Integrity API.
App sends the token with its request to your server The app doesn't read the verdict.
Server has Google decode the token and checks the verdict and nonce Verified off-device.
Server allows, challenges or blocks the action Based on risk.

30-second answer

Play Integrity lets your server check that a request comes from your genuine app, installed from Google Play, on a genuine certified Android device. The app requests a token and sends it to your backend, which has Google decrypt and verify it, then decides. It replaced the SafetyNet Attestation API, which has been shut down. Use verdicts as risk signals, not a hard block for every user.

Practise saying it · 30 s. No recording, just a timer

Explain Play Integrity.

Say your answer out loud, then check which of these points you covered:

Genuine app, Play, device
Token verified on server
Replaced SafetyNet
Nonce to stop replay
Risk signal, not a blanket block

Deep dive

Verdicts include app recognition, device integrity levels (basic, device, strong) and licensing.

Standard requests are low-latency and good for frequent checks; classic requests are for rarer, high-value actions.

Never trust the verdict in the app; decide on the server.

Bind requests with a nonce or request hash to stop replay.

Common mistakes

Checking the verdict on the client.
Blocking all users without strong integrity, including legitimate custom ROM users.
Still using SafetyNet.

Senior take & follow-ups

Explain the flow app→server→Google, and the 'risk signal' mindset.

Follow-up questions

Think of your answer first, then open the hint.

Why verify on the server?
Show hint
An attacker controls the client and can fake a local check.
What stops token replay?
Show hint
A request hash or nonce tied to the specific action.

Similar on iOS: Jailbreak detection iOS uses App Attest and DeviceCheck instead of root checks.

Suggest a fix if something here is wrong or out of date.