1

What is the difference between Play Integrity implementation here and the one that is in Firebase documentation, which one should you follow? I also don't understand the one that is in the Play Store documentation as all it did is add the dependency, thus I am assuming that Google Play Services handles it automatically behind the scenes as long as it detects that the app has the Play Integrity dependency.

Alex Mamo
  • 130,605
  • 17
  • 163
  • 193
Bitwise DEVS
  • 2,858
  • 4
  • 24
  • 67

1 Answers1

0

There is a huge difference between Play Store's Play Integrity and Firebase App Check with Play Integrity. In the case of Play Integrity, you can call the Integrity API at important moments in your app to check that user actions and requests are coming from your unmodified app binary, installed by Google Play, running on a genuine Android device. So it's about Google Play and nothing else.

On the other hand, Firebase App Check with Play Integrity, helps you protect your API resources from abuse by preventing unauthorized clients from accessing your backend resources. So besides the fact that you should have a Firebase project in the first place, this feature ensures that the calls to your backend originate from your authentic app.

Alex Mamo
  • 130,605
  • 17
  • 163
  • 193
  • Does this mean that if the Android project is using Firebase services and has dependency with App Check, then we no longer need to add Play Store's Play Integrity which I assume is treated as standalone? For now when looking at the Play Console's App Integrity section there is a step "Integrate the Play Integrity API" that is not yet strikethrough. – Bitwise DEVS Aug 31 '23 at 06:19
  • 1
    No, it doesn't mean that. You should use both of them, one to secure via Play Store and the other one to secure the Firebase backend. If it isn't strikethrough, it means that is not yet implemented. – Alex Mamo Aug 31 '23 at 08:27
  • Thanks, do you happen to know if there is a future plan for App Check and Play Integrity to support apps that are publish in other store such as Amazon or Samsung since Firebase Auth started to support device that has no Google Services lately? – Bitwise DEVS Aug 31 '23 at 12:39
  • I'm not aware of something like this. Btw, nice question. – Alex Mamo Aug 31 '23 at 12:45
  • Sorry follow up question, can't we just reuse the Play Integrity included in Firebase App Check if you want to use it on other part like HTTP API calls instead of adding Google Play's Integrity App Check again? Does the Play Integrity in Firebase App Check still differs from the one that is in Google Play Store? – Bitwise DEVS Sep 01 '23 at 12:46
  • I personally did not try that. So I cannot say if it works that way or not. You should try that yourself or ask another question, so other developers can help you. – Alex Mamo Sep 01 '23 at 12:53