Method: oauthClients.exchangeAppAttestAssertion

Accepts an App Attest assertion and an artifact previously obtained from oauthClients.exchangeAppAttestAttestation and verifies those with Apple. If valid, returns an AppCheckToken .

HTTP request

POST https://firebaseappcheck.googleapis.com/v1/{app=oauthClients/*}:exchangeAppAttestAssertion

The URL uses gRPC Transcoding syntax.

Path parameters

Parameters
app

string

Required. The relative resource name of the iOS app, in the format: 

projects/{project_number}/apps/{app_id}

If necessary, the project_number element can be replaced with the project ID of the Firebase project. Learn more about using project identifiers in Google's AIP 2510 standard.

Request body

The request body contains data with the following structure:

JSON representation 
{
  "artifact": string,
  "assertion": string,
  "challenge": string,
  "limitedUse": boolean
}
Fields
artifact

string ( bytes format)

Required. The artifact returned by a previous call to oauthClients.exchangeAppAttestAttestation .

A base64-encoded string.

assertion

string ( bytes format)

Required. The CBOR-encoded assertion returned by the client-side App Attest API.

A base64-encoded string.

challenge

string ( bytes format)

Required. A one-time challenge returned by an immediately prior call to oauthClients.generateAppAttestChallenge .

A base64-encoded string.

limitedUse

boolean

Specifies whether this attestation is for use in a limited use ( true ) or session based ( false ) context. To enable this attestation to be used with the replay protection feature, set this to true . The default value is false .

Response body

If successful, the response body contains an instance of AppCheckToken .