Method: oauthClients.exchangeAppAttestAttestation

Accepts an App Attest CBOR attestation and verifies it with Apple using your preconfigured team and bundle IDs. If valid, returns an attestation artifact that can later be exchanged for an AppCheckToken using oauthClients.exchangeAppAttestAssertion .

For convenience and performance, this method's response object will also contain an AppCheckToken (if the verification is successful).

HTTP request

POST https://firebaseappcheck.googleapis.com/v1beta/{app=oauthClients/*}:exchangeAppAttestAttestation

The URL uses gRPC Transcoding syntax.

Path parameters

Parameters
app

string

Required. The relative resource name of the iOS app, in the format: 

projects/{project_number}/apps/{app_id}

If necessary, the project_number element can be replaced with the project ID of the Firebase project. Learn more about using project identifiers in Google's AIP 2510 standard.

Alternatively, if this method is being called for an OAuth client protected by App Check, this field can also be in the format: 

oauthClients/{oauth_client_id}

You can view the OAuth client ID for your OAuth clients in the Google Cloud console. Note that only iOS OAuth clients are supported at this time, and they must be linked to corresponding iOS Firebase apps. Please see the documentation for more information.

Request body

The request body contains data with the following structure:

JSON representation 
{
  "attestationStatement": string,
  "challenge": string,
  "keyId": string,
  "limitedUse": boolean
}
Fields
attestationStatement

string ( bytes format)

Required. The App Attest statement returned by the client-side App Attest API. This is a base64url encoded CBOR object in the JSON response.

A base64-encoded string.

challenge

string ( bytes format)

Required. A one-time challenge returned by an immediately prior call to oauthClients.generateAppAttestChallenge .

A base64-encoded string.

keyId

string ( bytes format)

Required. The key ID generated by App Attest for the client app.

A base64-encoded string.

limitedUse

boolean

Specifies whether this attestation is for use in a limited use ( true ) or session based ( false ) context. To enable this attestation to be used with the replay protection feature, set this to true . The default value is false .

Response body

If successful, the response body contains an instance of ExchangeAppAttestAttestationResponse .