Mobile Security
Play Integrity API:
what it proves and what it does not
The Play Integrity API gives your server a signed verdict on whether a request comes from a recognised app on a genuine Android device. It is a snapshot, not continuous protection, and it can be defeated on some compromised devices, so it should be one signal among several.
What is the Play Integrity API?
The Play Integrity API is Google's service for checking that a request comes from a genuine app on a genuine Android device. Your app asks for an integrity token, sends it to your server, and your server verifies the signed verdict before trusting the request. It replaced the older SafetyNet attestation.
What a good verdict tells you
- The app binary is the one Google Play recognises, not a repackaged copy.
- The device passes Google's integrity checks at a basic, device or strong level.
- The request carries a nonce you chose, so a token cannot simply be reused for another action, if you bind it correctly.
What it does not prove
- What happens after the check. A verdict is a snapshot. It says nothing about a hooking framework attached a moment later.
- Who is driving the session. It cannot tell a genuine customer from a customer being guided by a scammer over screen sharing.
- Devices without Google services. The API depends on Google Play services being present.
- Resistance to every compromised device. On some rooted devices, spoofing modules can return favourable verdicts.
- Replay safety by default. If the nonce is not tied to the specific request, a valid token can be reused.
How to use it without over-trusting it
Bind the nonce to the action being authorised, verify the token on the server, treat the verdict as one signal in a score, and combine it with runtime checks and a hardware-backed device key so the server can recognise the same device across sessions. Decide the response (allow, step up, limit, block) on the server. Mobile RASP guide → · Hardware-bound identity → · Why root detection gets bypassed →
Frequently asked questions
What does the Play Integrity API tell you?
It returns signed verdicts about the app and device making a request, such as whether the app binary is recognised by Google Play and whether the device passes basic, device or strong integrity checks. You verify the verdict on your server.
Can the Play Integrity API be bypassed?
On some compromised devices, spoofing modules can make a device return favourable verdicts, and a token can be replayed if the request nonce is not bound to the action. That is why it should be one input to a risk decision, not the decision.
Does it replace RASP?
No. It describes the device and app at the time of the request. It does not watch for hooking, overlays or screen sharing happening while the app runs.
What is the iOS equivalent?
Apple's App Attest lets an app prove that a key was generated in the Secure Enclave of a genuine device and that the app is the one Apple knows. It has similar strengths and limits.
See it on your app.
Book a free 30-day shadow pilot, or download the platform brochure.