Skip to content
OpenParablePublic APIs

Firebase App Check API API

by googleapis.com

OAuthHTTPSAnalytics
Open documentation ↗

Overview

Firebase App Check works alongside other Firebase services to help protect your backend resources from abuse, such as billing fraud or phishing.

Firebase App Check API is an analytics API from googleapis.com. Requests are authenticated with OAuth. It is served over HTTPS. Its OpenAPI description documents 24 endpoints.

At a glance

Authentication
OAuth
HTTPS
Yes
CORS
Unknown
Category
Analytics
Base URL
https://firebaseappcheck.googleapis.com/
Version
v1
Endpoints
24
OpenAPI
Specification ↗
Spec updated
2023-02-17

Make a first request

Replace the placeholders; the documentation says exactly where credentials go.

cURL
curl -X GET "https://firebaseappcheck.googleapis.com/v1/NAME" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer YOUR_TOKEN"
JavaScript
const response = await fetch("https://firebaseappcheck.googleapis.com/v1/NAME", {
  method: "GET",
  headers: {
    "Accept": "application/json",
    "Authorization": "Bearer YOUR_TOKEN",
  },
});
const data = await response.json();
console.log(data);
Python
import requests

response = requests.request(
    "GET",
    "https://firebaseappcheck.googleapis.com/v1/NAME",
    headers={
    "Accept": "application/json",
    "Authorization": "Bearer YOUR_TOKEN",
    },
    timeout=30,
)
print(response.json())

Endpoints

MethodPathWhat it does
POST/v1/{app}:exchangeAppAttestAssertionAccepts an App Attest assertion and an artifact previously obtained from ExchangeAppAttestAttestation and verifies those with Apple. If valid, returns an AppChe
POST/v1/{app}:exchangeAppAttestAttestationAccepts an App Attest CBOR attestation and verifies it with Apple using your preconfigured team and bundle IDs. If valid, returns an attestation artifact that c
POST/v1/{app}:exchangeCustomTokenValidates a custom token signed using your project's Admin SDK service account credentials. If valid, returns an AppCheckToken.
POST/v1/{app}:exchangeDebugTokenValidates a debug token secret that you have previously created using CreateDebugToken. If valid, returns an AppCheckToken. Note that a restrictive quota is enf
POST/v1/{app}:exchangeDeviceCheckTokenAccepts a [`device_token`](https://developer.apple.com/documentation/devicecheck/dcdevice) issued by DeviceCheck, and attempts to validate it with Apple. If val
POST/v1/{app}:exchangePlayIntegrityTokenValidates an [integrity verdict response token from Play Integrity](https://developer.android.com/google/play/integrity/verdict#decrypt-verify). If valid, retur
POST/v1/{app}:exchangeRecaptchaEnterpriseTokenValidates a [reCAPTCHA Enterprise response token](https://cloud.google.com/recaptcha-enterprise/docs/create-assessment#retrieve_token). If valid, returns an App
POST/v1/{app}:exchangeRecaptchaV3TokenValidates a [reCAPTCHA v3 response token](https://developers.google.com/recaptcha/docs/v3). If valid, returns an AppCheckToken.
POST/v1/{app}:exchangeSafetyNetTokenValidates a [SafetyNet token](https://developer.android.com/training/safetynet/attestation#request-attestation-step). If valid, returns an AppCheckToken.
POST/v1/{app}:generateAppAttestChallengeGenerates a challenge that protects the integrity of an immediately following call to ExchangeAppAttestAttestation or ExchangeAppAttestAssertion. A challenge sh
POST/v1/{app}:generatePlayIntegrityChallengeGenerates a challenge that protects the integrity of an immediately following integrity verdict request to the Play Integrity API. The next call to ExchangePlay
GET/v1/{name}Gets the Service configuration for the specified service name.
PATCH/v1/{name}Updates the specified Service configuration.
DELETE/v1/{name}Deletes the specified DebugToken. A deleted debug token cannot be used to exchange for an App Check token. Use this method when you suspect the secret `token` h
GET/v1/{parent}/apps/-/appAttestConfig:batchGetAtomically gets the AppAttestConfigs for the specified list of apps.
GET/v1/{parent}/apps/-/deviceCheckConfig:batchGetAtomically gets the DeviceCheckConfigs for the specified list of apps. For security reasons, the `private_key` field is never populated in the response.
GET/v1/{parent}/apps/-/playIntegrityConfig:batchGetAtomically gets the PlayIntegrityConfigs for the specified list of apps.
GET/v1/{parent}/apps/-/recaptchaEnterpriseConfig:batchGetAtomically gets the RecaptchaEnterpriseConfigs for the specified list of apps.
GET/v1/{parent}/apps/-/recaptchaV3Config:batchGetAtomically gets the RecaptchaV3Configs for the specified list of apps. For security reasons, the `site_secret` field is never populated in the response.
GET/v1/{parent}/apps/-/safetyNetConfig:batchGetAtomically gets the SafetyNetConfigs for the specified list of apps.
GET/v1/{parent}/debugTokensLists all DebugTokens for the specified app. For security reasons, the `token` field is never populated in the response.
POST/v1/{parent}/debugTokensCreates a new DebugToken for the specified app. For security reasons, after the creation operation completes, the `token` field cannot be updated or retrieved,
GET/v1/{parent}/servicesLists all Service configurations for the specified project. Only Services which were explicitly configured using UpdateService or BatchUpdateServices will be re
POST/v1/{parent}/services:batchUpdateAtomically updates the specified Service configurations.

Questions

Does the Firebase App Check API API need an API key?

Yes. The Firebase App Check API API uses OAuth authentication; the documentation explains how to get credentials.

Does the Firebase App Check API API support HTTPS?

Yes, the Firebase App Check API API is served over HTTPS.

How many endpoints does the Firebase App Check API API have?

Its OpenAPI description lists 24 endpoints in version v1. All of them are shown on this page.

What are alternatives to the Firebase App Check API API?

Other Analytics APIs include Google Play Integrity API, versionhistory.googleapis.com API, Doc Converter, Perspective Comment Analyzer API, Safe Browsing API.

Compare alternatives →

Google Play Integrity API

Analytics

The Play Integrity API helps you check that you're interacting with your genuine app on a genuine Android device powered by Google Play services. The Play Integrity API has replaced SafetyNet Attestation and Android Device Verification.

OAuth1 endpoints

versionhistory.googleapis.com API

Analytics

Version History API - Prod

No auth4 endpoints

Doc Converter

Analytics

This api converts file formats of OpenXml and OpenOffice documents formats to vector files (e.g., svg)

No auth1 endpoints

Perspective Comment Analyzer API

Analytics

The Perspective Comment Analyzer API provides information about the potential impact of a comment on a conversation (e.g. it can provide a score for the "toxicity" of a comment). Users can leverage the "SuggestCommentScore" method to submit corrections to improve Perspective over time. Users can set the "doNotStore" flag to ensure that all submitted comments are automatically deleted after scores are returned.

OAuth2 endpoints

Safe Browsing API

Analytics

Enables client applications to check web resources (most commonly URLs) against Google-generated lists of unsafe web resources. The Safe Browsing APIs are for non-commercial use only. If you need to use APIs to detect malicious URLs for commercial purposes – meaning “for sale or revenue-generating purposes” – please refer to the Web Risk API.

No auth7 endpoints

Web Fonts Developer API

Analytics

The Google Web Fonts Developer API lets you retrieve information about web fonts served by Google.

No auth1 endpoints

Listed from APIs.guru (CC0).