App attestation failed with Firebase App check in release on Android

Question

Integrating Firebase into my Android app and have configured it with the SHA-256 certificate fingerprint from my Google key. However, the setup isn't working, and all requests to Firebase are blocked.

Error output:

Error getting App Check token; using placeholder token instead. Error: n8.j: Error returned from API. code: 403 body: App attestation failed.

I've followed the docs:

1. Enabled APIs

2. Add the code in my app

---

Code :

    Firebase.initialize(context = this)
    if (BuildConfig.DEBUG) {
        Firebase.appCheck.installAppCheckProviderFactory(
            DebugAppCheckProviderFactory.getInstance(),
        )
    } else {
        Firebase.appCheck.installAppCheckProviderFactory(
            PlayIntegrityAppCheckProviderFactory.getInstance(),
        )
    }

Added the SHA256 of the signature key provided in the Play console -> key management section

It works on debug but not on release.

Is there a specific setting that I might be missing, or could this be an issue with the fingerprint itself?

Cytochemistry

Have you generated and downloaded google-services.json file from Google Cloud Project > API & Services > Credentials > API Keys and used same file in your project ? – Cytochemistry

I can't download google-services.json from API keys, but there is an API key "Android key (auto created by Firebase)" and the value of this key is the same as the "current_key" inside my google-services.json – Cytochemistry

can you match the package name of app.gradle and and firebase json – Cytochemistry

Yes the package name is the same :/ – Cytochemistry

You need to generate new build from Google certificate and install that build and check in device for firebase is working or not. – Cytochemistry

I don't understand: - "new build from Google certificate" ? - " check in device for firebase" ? – Cytochemistry

check this link for more information developer.android.com/studio/publish/app-signing#enroll – Cytochemistry

My app is already signed with Google App signing – Cytochemistry

Did you download the app from the Google Play Store on a real device? – Flare

Yes the app is dowloaded on a real device, from Google Play but from the internal testing channel. Could it be the issue? – Cytochemistry

yes, that's the problem – Beaubeauchamp

So I need to push it in production in order to test it? That's weird, no? – Cytochemistry

Answer 1

I finally created a new app (with a new package name) on the Google Play console and everything works now 🥸.

I don't know if with my multiple attempts, I've been "blacklisted" by Appcheck but anyway, if someone faces the same issue, just create a new app.

Cytochemistry