Play Integrity/SafetyNet Basics

Copy code// implementation("com.google.android.play:integrity:1.3.0")

class IntegrityChecker(private val context: Context) {
    private val integrityManager = IntegrityManagerFactory.create(context)

    suspend fun getIntegrityToken(requestHash: String): String = suspendCoroutine { cont ->
        val request = IntegrityTokenRequest.newBuilder()
            .setNonce(requestHash)  // should be a hash of the request content
            .build()

        integrityManager.requestIntegrityToken(request)
            .addOnSuccessListener { response ->
                cont.resume(response.token())
            }
            .addOnFailureListener { exception ->
                cont.resumeWithException(exception)
            }
    }
}

Copy codeClient:
  1. Generate nonce = SHA256(request_body + timestamp + user_id)
  2. Request token with this nonce
  3. Send API request + token to your server

Server:
  1. POST token to: https://playintegrity.googleapis.com/v1/{package}:decodeIntegrityToken
  2. Parse verdicts: appIntegrity, deviceIntegrity, accountDetails
  3. Verify nonce matches the request (anti-replay)
  4. Accept or reject based on verdict thresholds

Copy code// Retrofit interface for sending token to your backend
interface ApiService {
    @POST("api/protected-action")
    suspend fun performAction(
        @Body request: ActionRequest
    ): ActionResponse
}

data class ActionRequest(
    val actionData: String,
    val integrityToken: String,     // Play Integrity token
    val nonce: String               // client-generated nonce
)

// Usage in ViewModel
class PurchaseViewModel(
    private val integrityChecker: IntegrityChecker,
    private val apiService: ApiService
) : ViewModel() {
    fun purchaseItem(itemId: String) = viewModelScope.launch {
        val requestData = "purchase:$itemId:${System.currentTimeMillis()}"
        val nonce = sha256(requestData)

        val token = try {
            integrityChecker.getIntegrityToken(nonce)
        } catch (e: IntegrityServiceException) {
            handleError(e); return@launch
        }

        apiService.performAction(ActionRequest(requestData, token, nonce))
    }
}

Copy codeAPP_INTEGRITY:
  PLAY_RECOGNIZED     — genuine, non-tampered app from Google Play ✅
  UNRECOGNIZED_VERSION — side-loaded APK or unreleased version ⚠️
  UNEVALUATED         — not enough information ⚠️

DEVICE_INTEGRITY:
  MEETS_DEVICE_INTEGRITY  — CTS certified device ✅
  MEETS_BASIC_INTEGRITY   — passes basic but not CTS (custom ROM) ⚠️
  (empty)                 — failed all checks ❌

ACCOUNT_DETAILS:
  LICENSED     — user's Google account licensed this app ✅
  UNLICENSED   — not licensed (pirated) ❌
  UNEVALUATED  — couldn't verify ⚠️

Copy code// Server-side policy (pseudocode)
fun evaluateIntegrity(verdict: IntegrityVerdict): Action {
    return when {
        // Strict: require full integrity for financial operations
        verdict.appIntegrity != "PLAY_RECOGNIZED" ||
        verdict.deviceIntegrity.isEmpty() ->
            Action.BLOCK

        // Medium: allow degraded experience for basic integrity
        verdict.deviceIntegrity == "MEETS_BASIC_INTEGRITY" && !isFinancialAction ->
            Action.ALLOW_WITH_CAPTCHA

        // Allow: passes all checks
        else -> Action.ALLOW
    }
}