Decode integrity token using Google PlayIntegrity API

E

6

8

I am trying to implement PlayIntegrity API to my Android app, but I don't know how to decrypt and verify the token using Google's servers.

I followed the documentation up to this point:

And now I am stuck on making the decode request to googleapis. I don't understand how does this instruction work.

I created a Service Account and I downloaded JSON credentials file and put it into my Laravel project, then I tried this piece of code:

$client = new Client();
$client->setAuthConfig(storage_path('app/integrity_check_account.json'));
$client->addScope(PlayIntegrity::class);
$httpClient = $client->authorize();

$result = $httpClient->request('POST', 'https://playintegrity.googleapis.com/v1/my.package.name', [
    'headers' => ['Content-Type' => 'application/json'],
    'body' => "{ 'integrity_token': 'token' }"
]);

dd($result);

So I having two issues with this code:

Am I adding the scope correctly?
Am I making the request correctly? Because it is not working as I am getting 404 error.

Ebeneser answered 18/3, 2022 at 11:26 Comment(2)

Your request body does not look like a valid JSON document (single instead of double quotes) – Cohin 10/9, 2023 at 17:9

@Cohin this was never the issue. – Ebeneser 11/9, 2023 at 6:32

E

5

I finally found the solution to my problem while looking at the source of the PlayIntegrity API from the Google APIs Client Library for PHP.

After importing required dependencies:

composer require google/apiclient:^2.12.1

This is my controller:

<?php

namespace App\Http\Controllers;

use Google\Client;
use Google\Service\PlayIntegrity;
use Google\Service\PlayIntegrity\DecodeIntegrityTokenRequest;
use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
use Illuminate\Foundation\Bus\DispatchesJobs;
use Illuminate\Foundation\Validation\ValidatesRequests;
use Illuminate\Http\Request;
use Illuminate\Routing\Controller as BaseController;

class Controller extends BaseController {
    use AuthorizesRequests, DispatchesJobs, ValidatesRequests;

    public function performCheck(Request $request) {
        $client = new Client();
        $client->setAuthConfig(path/to/your/credentials/json/file.json);
        $client->addScope(PlayIntegrity::PLAYINTEGRITY);
        $service = new PlayIntegrity($client);
        $tokenRequest = new DecodeIntegrityTokenRequest();
        $tokenRequest->setIntegrityToken("TOKEN_HERE");
        $result = $service->v1->decodeIntegrityToken('PACKGE_NAME_HERE', $tokenRequest);
        
        //Integrity check logic below

        //check with old nonce that you need to save somewhere
        if ($oldNonce !== $resultNonce) {
           echo "bad nonce";
           exit(1);
        }

        $deviceVerdict = $result->deviceIntegrity->deviceRecognitionVerdict;
        $appVerdict = $result->appIntegrity->appRecognitionVerdict;
        $accountVerdict = $result->accountDetails->appLicensingVerdict;
   
        //Possible values of $deviceVerdict[0] : MEETS_BASIC_INTEGRITY, MEETS_DEVICE_INTEGRITY, MEETS_STRONG_INTEGRITY
        if (!isset($deviceVerdict) || $deviceVerdict[0] !== 'MEETS_DEVICE_INTEGRITY') {
              echo "device doesn't meet requirement";
              exit(1);
        }

       //Possible values of $appVerdict: PLAY_RECOGNIZED, UNRECOGNIZED_VERSION, UNEVALUATED
        if ($appVerdict !== 'PLAY_RECOGNIZED') {
            echo "App not recognized";
            exit(1);
        }

       //Possible values of $accountVerdict: LICENSED, UNLICENSED, UNEVALUATED
       if ($accountVerdict !== 'LICENSED') {
           echo "User is not licensed to use app";
           exit(1);
       }
    }
}

Possible return verdicts are explained here.

Ebeneser answered 18/3, 2022 at 14:41 Comment(8)

did you manage to get this working? I'm struggling with the decodeIntegrityToken request - not the same error you was receiving but a 400 BAD REQUEST with status INVALID_ARGUMENT. Did you bumped into this any time during your debug? My body contains a "integrity_token" with the value I've received from the client-side flow. Thanks – Endurable 22/3, 2022 at 21:15

Yes it is working fine for me.INVALID_ARGUMENT may occur if you forget to put your token or package name. It also will occur if your token is badly formatted. Also the nonce needs to be base64 encoded with NO_PADDING, NO_WRAPPING and URL_SAFE. – Ebeneser 22/3, 2022 at 21:26

@hiddeneyes02 Where are you generating Nonce ? In app code or at back end ? – Superhighway 13/5, 2022 at 11:23

@Superhighway You generate it from server side. In my case, when a user request something from my API, if the user was not authorized before, a nonce will be generated (and saved in the server's database) and sent back to app to initiate an Integrity Check. The nonce is then sent to Google Play to include in the crypted token answer, which is transferred back to my server, then my server sends it back to Google Play API which returns decrypted message with the original nonce, then I finally check the returned nonce with the one saved in my database. Nonce mismatch means something wrong occurred. – Ebeneser 13/5, 2022 at 14:51

I get a json in result first so for example $result->deviceIntegrity is null, despite a good reply. Example $result: NOTE: This is for a local development install: {"tokenPayloadExternal":{"requestDetails":"nonce":"mynoncebase64","requestPackageName":"mypackage","timestampMillis":"1655543757126"},"appIntegrity":{"appRecognitionVerdict":"UNRECOGNIZED_VERSION","certificateSha256Digest":["somecertdata"],"packageName":"mypackage","versionCode":"myversion"}, "deviceIntegrity":{"deviceRecognitionVerdict":["MEETS_DEVICE_INTEGRITY"]}, "accountDetails":{"appLicensingVerdict":"UNLICENSED"} }} – Bugle 18/6, 2022 at 12:3

May I also suggest the following composer.json to only load needed files: { "require": { "google/apiclient": "^2.7" }, "scripts": { "post-update-cmd": "Google_Task_Composer::cleanup" }, "extra": { "google/apiclient-services": [ "PlayIntegrity" ] } } – Bugle 19/6, 2022 at 8:33

@hiddeneyes02 While executing decode integrity token, I am getting 403 Forbidden with reason "You are not authorized to decode the requested integrity token." Have u by any chance gone through this while your debug? – Joniejonina 30/11, 2022 at 13:4

@UrvashiSoni Some setup is also required from your Google Play console. Go to Setup -> App Integrity and complete required steps. – Ebeneser 30/11, 2022 at 15:20

S

8

I have spent hours to get it work with node js. Sometimes Google is very terrible to document/explain and check its own code.

So I post this for anyone who is looking for integrity decryption with a node js server. The only example I could found is directly inside the node playintegrity module of googleapis. Based on this example here my working code:

async function getAppToken() {

  const auth = new google.auth.GoogleAuth({
    keyFile: 'secret.json',
    scopes: ['https://www.googleapis.com/auth/playintegrity'],
  });

  const authClient = await auth.getClient();

  google.options({auth: authClient});

  const res = await playintegrity.decodeIntegrityToken (
  {
    packageName: 'com.example.myapp',
    requestBody:
        {
        "integrityToken": "myToken"
        }
    }
  );


  console.log(res.data);

  return res.data;
}

You can call that function like this

    getAppToken()
    .then(data => {
        console.log(data);
    })
   .catch(e => {
        console.error(e);
        throw e;
    });

And here we go! Hum... no, hold on. You also have to fix the integrity api. Go to your node project and find the v1.js file in the playintegrity module

it should be here: \node_modules\googleapis\build\src\apis\playintegrity

Now open it and add this line in the Playintegrity constructor

this.decodeIntegrityToken = this.v1.decodeIntegrityToken;

To get that

class Playintegrity {
    constructor(options, google) {
        this.context = {
            _options: options || {},
            google,
        };
        this.v1 = new Resource$V1(this.context);
        this.decodeIntegrityToken = this.v1.decodeIntegrityToken;
    }
}

Now it should work

Stipulation answered 9/6, 2022 at 20:31 Comment(4)

I can confirm this works. Remember to add const playintegrity = google.playintegrity('v1'); – Mahayana 31/7, 2022 at 6:29

I figured it out without editing node_modules: playintegrity.v1.decodeIntegrityToken (the .v1.). Even their sample code is wrong!!! – Thorazine 28/9, 2022 at 8:12

I want to add like 100 times for "Google is terrible to document" – Incudes 22/2, 2023 at 9:29

Not sure if the Node.js googleapis package has changed, by I got this to work by building an integrity object like so: const playintegrity = google.playintegrity('v1'); const res = await playintegrity.v1.decodeIntegrityToken(params) – Daloris 25/9, 2023 at 21:41

E

5

I finally found the solution to my problem while looking at the source of the PlayIntegrity API from the Google APIs Client Library for PHP.

After importing required dependencies:

composer require google/apiclient:^2.12.1

This is my controller:

<?php

namespace App\Http\Controllers;

use Google\Client;
use Google\Service\PlayIntegrity;
use Google\Service\PlayIntegrity\DecodeIntegrityTokenRequest;
use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
use Illuminate\Foundation\Bus\DispatchesJobs;
use Illuminate\Foundation\Validation\ValidatesRequests;
use Illuminate\Http\Request;
use Illuminate\Routing\Controller as BaseController;

class Controller extends BaseController {
    use AuthorizesRequests, DispatchesJobs, ValidatesRequests;

    public function performCheck(Request $request) {
        $client = new Client();
        $client->setAuthConfig(path/to/your/credentials/json/file.json);
        $client->addScope(PlayIntegrity::PLAYINTEGRITY);
        $service = new PlayIntegrity($client);
        $tokenRequest = new DecodeIntegrityTokenRequest();
        $tokenRequest->setIntegrityToken("TOKEN_HERE");
        $result = $service->v1->decodeIntegrityToken('PACKGE_NAME_HERE', $tokenRequest);
        
        //Integrity check logic below

        //check with old nonce that you need to save somewhere
        if ($oldNonce !== $resultNonce) {
           echo "bad nonce";
           exit(1);
        }

        $deviceVerdict = $result->deviceIntegrity->deviceRecognitionVerdict;
        $appVerdict = $result->appIntegrity->appRecognitionVerdict;
        $accountVerdict = $result->accountDetails->appLicensingVerdict;
   
        //Possible values of $deviceVerdict[0] : MEETS_BASIC_INTEGRITY, MEETS_DEVICE_INTEGRITY, MEETS_STRONG_INTEGRITY
        if (!isset($deviceVerdict) || $deviceVerdict[0] !== 'MEETS_DEVICE_INTEGRITY') {
              echo "device doesn't meet requirement";
              exit(1);
        }

       //Possible values of $appVerdict: PLAY_RECOGNIZED, UNRECOGNIZED_VERSION, UNEVALUATED
        if ($appVerdict !== 'PLAY_RECOGNIZED') {
            echo "App not recognized";
            exit(1);
        }

       //Possible values of $accountVerdict: LICENSED, UNLICENSED, UNEVALUATED
       if ($accountVerdict !== 'LICENSED') {
           echo "User is not licensed to use app";
           exit(1);
       }
    }
}