Android Setup & Backend Verification

GitHub

Copy a setup prompt with the install steps and the full markdown guide for this plugin.

Android native system used

On Android, this plugin uses Google Play Integrity Standard API:

prepareIntegrityToken 在此期间 prepare()
requestStandardIntegrityToken 为此 createAttestation() 并且 createAssertion()

需求

通过 Google Play 生态系统分发的 Android 应用
设备上可用的 Google Play 服务
为您的应用启用了 Play Integrity API
已配置的 Google 云项目号

Google 设置

启用 Play Integrity API 在您的Google Cloud项目中使用。
在Play控制台中打开并为您的应用程序配置Play Integrity访问权限。
提供 cloudProjectNumber 到插件

Capacitor 配置

plugins: {
  AppAttest: {
    cloudProjectNumber: '123456789012',
  },
}

您还可以通过 cloudProjectNumber 每次调用在方法选项中传递。

客户端流程

import { AppAttest } from '@capgo/capacitor-app-attest';

const { keyId } = await AppAttest.prepare({
  cloudProjectNumber: '123456789012',
});

const attestation = await AppAttest.createAttestation({
  keyId,
  challenge: 'backend-registration-challenge',
});

const assertion = await AppAttest.createAssertion({
  keyId,
  payload: 'backend-request-payload',
});

token __CAPGO_KEEP_0__

这是一个Play Integrity令牌，必须在服务器端解码。

客户端流程（Android）`createAttestation`)

后端创建一次性令牌 challenge.
应用程序调用 createAttestation({ keyId, challenge }).
后端调用Google decodeIntegrityToken API.
Android后端工作流
- requestDetails.requestHash === base64url(SHA256(challenge))
- appIntegrity.packageName 等同于您的 Android 应用程序 ID
- appIntegrity.certificateSha256Digest 包含您的发布签名证书摘要
- 完整性判决与您的安全策略匹配

请求保护 (`createAssertion`)

后端创建一次性 payload.
应用程序调用 createAssertion({ keyId, payload }).
后端解码令牌并检查 requestHash === base64url(SHA256(payload)).
强制实施重放防护 (单次使用 + TTL) 和完整性判决策略

Android schema

sequenceDiagram
  participant App as Android App
  participant Plugin as AppAttest plugin
  participant PlaySDK as Play Integrity SDK
  participant BE as Backend
  participant Google as decodeIntegrityToken API

  App->>Plugin: prepare(cloudProjectNumber)
  Plugin->>PlaySDK: prepareIntegrityToken()
  PlaySDK-->>Plugin: provider handle (keyId)

  BE->>App: one-time challenge
  App->>Plugin: createAttestation(keyId, challenge)
  Plugin->>PlaySDK: requestStandardIntegrityToken(requestHash)
  PlaySDK-->>Plugin: integrity token
  Plugin-->>App: token + platform + format + keyId
  App->>BE: token + challenge + keyId
  BE->>Google: decodeIntegrityToken(token)
  Google-->>BE: decoded payload
  BE->>BE: verify requestHash + app identity + verdicts

  BE->>App: one-time payload
  App->>Plugin: createAssertion(keyId, payload)
  Plugin->>PlaySDK: requestStandardIntegrityToken(requestHash)
  PlaySDK-->>Plugin: integrity token
  App->>BE: token + payload + keyId
  BE->>Google: decodeIntegrityToken(token)
  Google-->>BE: decoded payload
  BE->>BE: verify requestHash + replay policy

最小后端载荷契约

{
  "platform": "android",
  "format": "google-play-integrity-standard",
  "keyId": "string",
  "challenge": "string",
  "token": "string"
}

断言：

{
  "platform": "android",
  "format": "google-play-integrity-standard",
  "keyId": "string",
  "payload": "string",
  "token": "string"
}

从安卓设置和后端验证继续

如果您正在使用 安卓设置和后端验证 来规划安全性和合规性，连接它到使用@capgo/capacitor-app-attest 为使用@capgo/capacitor-app-attest的原生能力加密为加密的实现细节合规为合规的实现细节 Capgo 安全扫描器为Capgo 安全扫描器的产品工作流程 Capgo 安全为Capgo 安全的产品工作流程

Android Setup &amp; Backend Verification