Accepts an App Attest assertion and an artifact previously obtained from
oauthClients.exchangeAppAttestAttestation
and verifies those with Apple. If valid, returns an
AppCheckToken
.
HTTP request
POST https://firebaseappcheck.googleapis.com/v1beta/{app=oauthClients/*}:exchangeAppAttestAssertion
The URL uses gRPC Transcoding syntax.
Path parameters
Parameters | |
---|---|
app
|
Required. The relative resource name of the iOS app, in the format:
If necessary, the
Alternatively, if this method is being called for an OAuth client protected by App Check, this field can also be in the format:
You can view the OAuth client ID for your OAuth clients in the Google Cloud console. Note that only iOS OAuth clients are supported at this time, and they must be linked to corresponding iOS Firebase apps. Please see the documentation for more information. |
Request body
The request body contains data with the following structure:
JSON representation |
---|
{ "artifact": string, "assertion": string, "challenge": string, "limitedUse": boolean } |
Fields | |
---|---|
artifact
|
Required. The artifact returned by a previous call to
A base64-encoded string. |
assertion
|
Required. The CBOR-encoded assertion returned by the client-side App Attest API. A base64-encoded string. |
challenge
|
Required. A one-time challenge returned by an immediately prior call to
A base64-encoded string. |
limitedUse
|
Specifies whether this attestation is for use in a
limited use
(
|
Response body
If successful, the response body contains an instance of
AppCheckToken
.