Accepts an App Attest CBOR attestation and verifies it with Apple using your preconfigured team and bundle IDs. If valid, returns an attestation artifact that can later be exchanged for an
AppCheckToken
using
oauthClients.exchangeAppAttestAssertion
.
For convenience and performance, this method's response object will also contain an
AppCheckToken
(if the verification is successful).
HTTP request
POST https://firebaseappcheck.googleapis.com/v1/{app=oauthClients/*}:exchangeAppAttestAttestation
The URL uses gRPC Transcoding syntax.
Path parameters
Parameters | |
---|---|
app
|
Required. The relative resource name of the iOS app, in the format:
If necessary, the
|
Request body
The request body contains data with the following structure:
JSON representation |
---|
{ "attestationStatement": string, "challenge": string, "keyId": string, "limitedUse": boolean } |
Fields | |
---|---|
attestationStatement
|
Required. The App Attest statement returned by the client-side App Attest API. This is a base64url encoded CBOR object in the JSON response. A base64-encoded string. |
challenge
|
Required. A one-time challenge returned by an immediately prior call to
A base64-encoded string. |
keyId
|
Required. The key ID generated by App Attest for the client app. A base64-encoded string. |
limitedUse
|
Specifies whether this attestation is for use in a
limited use
(
|
Response body
If successful, the response body contains an instance of
ExchangeAppAttestAttestationResponse
.