Method: projects.verifyAppCheckToken

Verifies the given App Check token and returns token usage signals that callers may act upon. This method currently only supports App Check tokens exchanged from the following attestation providers:

  • Play Integrity API
  • App Attest
  • DeviceCheck ( DCDevice tokens)
  • reCAPTCHA Enterprise
  • reCAPTCHA v3
  • Custom providers

App Check tokens exchanged from debug secrets are also supported. Calling this method on an otherwise valid App Check token with an unsupported provider will cause an HTTP 400 error to be returned.

Returns whether this token was already consumed before this call. If this is the first time this method has seen the given App Check token, the field alreadyConsumed in the response will be absent. The given token will then be marked as alreadyConsumed (set to true ) for all future invocations of this method for that token.

Note that if the given App Check token is invalid, an HTTP 403 error is returned instead of a response object, regardless whether the token was already consumed.

Currently, when evaluating whether an App Check token was already consumed, only calls to this exact method are counted. Use of the App Check token elsewhere will not mark the token as being already consumed.

The caller must have the firebaseappcheck.appCheckTokens.verify permission to call this method. This permission is part of the Firebase App Check Token Verifier role .

HTTP request

POST https://firebaseappcheck.googleapis.com/v1beta/{project=projects/*}:verifyAppCheckToken

The URL uses gRPC Transcoding syntax.

Path parameters

Parameters
project

string

Required. The relative resource name of the project for which the token was minted, in the format: 

projects/{project_number}

If necessary, the project_number element can be replaced with the project ID of the Firebase project. Learn more about using project identifiers in Google's AIP 2510 standard.

Request body

The request body contains data with the following structure:

JSON representation 
{
  "appCheckToken": string
}
Fields
appCheckToken

string

Required. The App Check token to verify.

App Check tokens exchanged from the SafetyNet provider are not supported; an HTTP 400 error will be returned.

Response body

Response message for the projects.verifyAppCheckToken method.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "alreadyConsumed": boolean
}
Fields
alreadyConsumed

boolean

Whether this token was already consumed.

If this is the first time this method has seen the given App Check token, this field will be omitted from the response. The given token will then be marked as alreadyConsumed (set to true ) for all future invocations of this method for that token.

Note that if the given App Check token is invalid, an HTTP 403 error is returned instead of a response containing this field, regardless whether the token was already consumed.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/firebase

For more information, see the Authentication Overview .