Stay organized with collections
Save and categorize content based on your preferences.
Accepts an App Attest CBOR attestation and verifies it with Apple using your preconfigured team and bundle IDs. If valid, returns an attestation artifact that can later be exchanged for an
AppCheckToken
using
apps.exchangeAppAttestAssertion
.
For convenience and performance, this method's response object will also contain an
AppCheckToken
(if the verification is successful).
HTTP request
POST https://firebaseappcheck.googleapis.com/v1/{app=projects/*/apps/*}:exchangeAppAttestAttestation
Required. The relative resource name of the iOS app, in the format:
projects/{project_number}/apps/{app_id}
If necessary, the
project_number
element can be replaced with the project ID of the Firebase project. Learn more about using project identifiers in Google's
AIP 2510
standard.
Request body
The request body contains data with the following structure:
Required. The key ID generated by App Attest for the client app.
A base64-encoded string.
limitedUse
boolean
Specifies whether this attestation is for use in a
limited use
(
true
) or
session based
(
false
) context. To enable this attestation to be used with the
replay protection
feature, set this to
true
. The default value is
false
.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2024-09-26 UTC."],[],[],null,["# Method: projects.apps.exchangeAppAttestAttestation\n\nAccepts an App Attest CBOR attestation and verifies it with Apple using your preconfigured team and bundle IDs. If valid, returns an attestation artifact that can later be exchanged for an\n`\n`[AppCheckToken](/docs/reference/appcheck/rest/v1/AppCheckToken)`\n`\nusing\n`\n`[apps.exchangeAppAttestAssertion](/docs/reference/appcheck/rest/v1/projects.apps/exchangeAppAttestAssertion#google.firebase.appcheck.v1.TokenExchangeService.ExchangeAppAttestAssertion)`\n`\n.\n\n\nFor convenience and performance, this method's response object will also contain an\n`\n`[AppCheckToken](/docs/reference/appcheck/rest/v1/AppCheckToken)`\n`\n(if the verification is successful).\n\n### HTTP request\n\n\n`\nPOST https://firebaseappcheck.googleapis.com/v1/{app=projects/*/apps/*}:exchangeAppAttestAttestation\n`\n\n\nThe URL uses\n[gRPC Transcoding](https://google.aip.dev/127)\nsyntax.\n\n### Path parameters\n\n| Parameters ||\n|---------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| ` app ` | ` string ` Required. The relative resource name of the iOS app, in the format: projects/{project_number}/apps/{app_id} If necessary, the ` project_number ` element can be replaced with the project ID of the Firebase project. Learn more about using project identifiers in Google's [AIP 2510](https://google.aip.dev/cloud/2510) standard. |\n\n### Request body\n\n\nThe request body contains data with the following structure:\n\n| JSON representation |\n|---------------------------------------------------------------------------------------------------------|\n| ``` { \"attestationStatement\": string, \"challenge\": string, \"keyId\": string, \"limitedUse\": boolean } ``` |\n\n| Fields ||\n|--------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| ` attestationStatement ` | ` string ( `[bytes](https://developers.google.com/discovery/v1/type-format)` format) ` Required. The App Attest statement returned by the client-side App Attest API. This is a base64url encoded CBOR object in the JSON response. A base64-encoded string. |\n| ` challenge ` | ` string ( `[bytes](https://developers.google.com/discovery/v1/type-format)` format) ` Required. A one-time challenge returned by an immediately prior call to ` `[apps.generateAppAttestChallenge](/docs/reference/appcheck/rest/v1/projects.apps/generateAppAttestChallenge#google.firebase.appcheck.v1.TokenExchangeService.GenerateAppAttestChallenge)` ` . A base64-encoded string. |\n| ` keyId ` | ` string ( `[bytes](https://developers.google.com/discovery/v1/type-format)` format) ` Required. The key ID generated by App Attest for the client app. A base64-encoded string. |\n| ` limitedUse ` | ` boolean ` Specifies whether this attestation is for use in a *limited use* ( ` true ` ) or *session based* ( ` false ` ) context. To enable this attestation to be used with the *replay protection* feature, set this to ` true ` . The default value is ` false ` . |\n\n### Response body\n\n\nIf successful, the response body contains an instance of\n`\n`[ExchangeAppAttestAttestationResponse](/docs/reference/appcheck/rest/v1/ExchangeAppAttestAttestationResponse)`\n`\n."]]