Android Setup & Backend Verification

GitHub

复制一个包含安装步骤和此插件的完整 Markdown 指南的配置提示。

使用 Android 原生系统

在 Android 上，这个插件使用 Google Play完整性标准 API:

prepareIntegrityToken 在 prepare()
requestStandardIntegrityToken 为了 createAttestation() and createAssertion()

需求

设备上可用的Google Play服务
为您的应用程序启用了Play Integrity __CAPGO_KEEP_0__
Play Integrity API enabled for your app
Google设置

启用

在您的Google Cloud项目中. Play Integrity API 在您的Google Cloud项目中.
打开Play控制台并为您的应用程序配置Play完整性访问权限.
提供 cloudProjectNumber 给插件.

Capacitor 配置

plugins: {
  AppAttest: {
    cloudProjectNumber: '123456789012',
  },
}

您还可以在方法选项中传递 cloudProjectNumber 每次调用

客户端流程

import { AppAttest } from '@capgo/capacitor-app-attest';

const { keyId } = await AppAttest.prepare({
  cloudProjectNumber: '123456789012',
});

const attestation = await AppAttest.createAttestation({
  keyId,
  challenge: 'backend-registration-challenge',
});

const assertion = await AppAttest.createAssertion({
  keyId,
  payload: 'backend-request-payload',
});

token 必须在服务器端解码的Play Integrity令牌。

Android后端工作流程（

创建认证（`createAttestation`)

后端创建一次性 challenge.
应用程序调用 createAttestation({ keyId, challenge }).
后端调用Google decodeIntegrityToken API.
后端至少验证：
- requestDetails.requestHash === base64url(SHA256(challenge))
- appIntegrity.packageName 等于您的Android应用程序ID
- appIntegrity.certificateSha256Digest 包含您的发布签名证书摘要
- integrity verdicts match your security policy

Request protection (`createAssertion`)

Backend creates one-time payload.
App calls createAssertion({ keyId, payload }).
Backend decodes token and checks requestHash === base64url(SHA256(payload)).
Enforce replay prevention (single-use + TTL) and integrity verdict policy.

Android schema

sequenceDiagram
  participant App as Android App
  participant Plugin as AppAttest plugin
  participant PlaySDK as Play Integrity SDK
  participant BE as Backend
  participant Google as decodeIntegrityToken API

  App->>Plugin: prepare(cloudProjectNumber)
  Plugin->>PlaySDK: prepareIntegrityToken()
  PlaySDK-->>Plugin: provider handle (keyId)

  BE->>App: one-time challenge
  App->>Plugin: createAttestation(keyId, challenge)
  Plugin->>PlaySDK: requestStandardIntegrityToken(requestHash)
  PlaySDK-->>Plugin: integrity token
  Plugin-->>App: token + platform + format + keyId
  App->>BE: token + challenge + keyId
  BE->>Google: decodeIntegrityToken(token)
  Google-->>BE: decoded payload
  BE->>BE: verify requestHash + app identity + verdicts

  BE->>App: one-time payload
  App->>Plugin: createAssertion(keyId, payload)
  Plugin->>PlaySDK: requestStandardIntegrityToken(requestHash)
  PlaySDK-->>Plugin: integrity token
  App->>BE: token + payload + keyId
  BE->>Google: decodeIntegrityToken(token)
  Google-->>BE: decoded payload
  BE->>BE: verify requestHash + replay policy

Minimal backend payload contract

{
  "platform": "android",
  "format": "google-play-integrity-standard",
  "keyId": "string",
  "challenge": "string",
  "token": "string"
}

断言：

{
  "platform": "android",
  "format": "google-play-integrity-standard",
  "keyId": "string",
  "payload": "string",
  "token": "string"
}

从Android设置和后端验证继续

如果您正在使用 Android设置和后端验证 来规划安全性和合规性，连接它到使用@capgo/capacitor-app-attest 为native能力在使用@capgo/capacitor-app-attest中加密关于加密的实现细节合规性关于合规性的实现细节 Capgo 安全扫描器 Capgo 安全扫描器的产品工作流程， Capgo 安全 Capgo 安全的产品工作流程，

Android Setup &amp; Backend Verification