Android Setup & Backend Verification

GitHub

复制一个包含安装步骤和此插件的完整 Markdown 指南的配置提示。

使用 Android 原生系统

在 Android 上，这个插件使用 Google Play完整性标准 API:

prepareIntegrityToken 期间 prepare()
requestStandardIntegrityToken 用于 createAttestation() 和 createAssertion()

需求

通过 Google Play 生态系统分发的 Android 应用
设备上可用的 Google Play 服务
为您的应用启用了 Play Integrity API
已配置的 Google 云端项目号

Google 设置

启用 在您的 Google 云端项目中启用 Play Integrity API 在您的 Google 云端项目中
打开Play控制台并为您的应用程序配置Play完整性访问权限.
提供 cloudProjectNumber 给插件.

Capacitor 配置

plugins: {
  AppAttest: {
    cloudProjectNumber: '123456789012',
  },
}

您还可以在方法选项中传递 cloudProjectNumber 每次调用

客户端流程

import { AppAttest } from '@capgo/capacitor-app-attest';

const { keyId } = await AppAttest.prepare({
  cloudProjectNumber: '123456789012',
});

const attestation = await AppAttest.createAttestation({
  keyId,
  challenge: 'backend-registration-challenge',
});

const assertion = await AppAttest.createAssertion({
  keyId,
  payload: 'backend-request-payload',
});

token 必须在服务器端解码.

Android后端流程（

注册（`createAttestation`)

后端创建一次性 challenge.
应用程序调用 createAttestation({ keyId, challenge }).
后端调用Google decodeIntegrityToken API.
后端至少验证：
- requestDetails.requestHash === base64url(SHA256(challenge))
- appIntegrity.packageName 等于您的Android应用程序ID
- appIntegrity.certificateSha256Digest 包含您的发布签名证书摘要
- integrity verdicts match your security policy

Request protection (`createAssertion`)

Backend creates one-time payload.
App calls createAssertion({ keyId, payload }).
Backend decodes token and checks requestHash === base64url(SHA256(payload)).
Enforce replay prevention (single-use + TTL) and integrity verdict policy.

Android schema

sequenceDiagram
  participant App as Android App
  participant Plugin as AppAttest plugin
  participant PlaySDK as Play Integrity SDK
  participant BE as Backend
  participant Google as decodeIntegrityToken API

  App->>Plugin: prepare(cloudProjectNumber)
  Plugin->>PlaySDK: prepareIntegrityToken()
  PlaySDK-->>Plugin: provider handle (keyId)

  BE->>App: one-time challenge
  App->>Plugin: createAttestation(keyId, challenge)
  Plugin->>PlaySDK: requestStandardIntegrityToken(requestHash)
  PlaySDK-->>Plugin: integrity token
  Plugin-->>App: token + platform + format + keyId
  App->>BE: token + challenge + keyId
  BE->>Google: decodeIntegrityToken(token)
  Google-->>BE: decoded payload
  BE->>BE: verify requestHash + app identity + verdicts

  BE->>App: one-time payload
  App->>Plugin: createAssertion(keyId, payload)
  Plugin->>PlaySDK: requestStandardIntegrityToken(requestHash)
  PlaySDK-->>Plugin: integrity token
  App->>BE: token + payload + keyId
  BE->>Google: decodeIntegrityToken(token)
  Google-->>BE: decoded payload
  BE->>BE: verify requestHash + replay policy

Minimal backend payload contract

{
  "platform": "android",
  "format": "google-play-integrity-standard",
  "keyId": "string",
  "challenge": "string",
  "token": "string"
}

断言:

{
  "platform": "android",
  "format": "google-play-integrity-standard",
  "keyId": "string",
  "payload": "string",
  "token": "string"
}

继续从 Android Setup 和后端验证

如果您正在使用 Android Setup 和后端验证 来规划安全性和合规性，连接它到使用 @capgo/capacitor-app-attest 来使用 Using @capgo/capacitor-app-attest 中的原生能力加密为加密的实现细节合规为合规的实现细节 Capgo 安全扫描器为Capgo 安全扫描器的产品工作流程, 和 Capgo 安全为Capgo 安全的产品工作流程

Android Setup &amp; Backend Verification