The Play Integrity API: what it checks and how to use it

Three verdicts come by default. appRecognitionVerdict is PLAY_RECOGNIZED when the binary is the one Google Play knows. appLicensingVerdict is LICENSED when the user got the app from Google Play, and you can show the GET_LICENSED dialog to users who did not. deviceIntegrity carries the device labels in the table. Opt-in verdicts add more: appAccessRiskVerdict for apps that could capture the screen, draw overlays or control the device, playProtectVerdict for Play Protect status and known malware, recentDeviceActivity for unusually many requests, and device recall, in beta, to recognise a device you flagged before even after a reinstall or reset.

Standard requests suit any app: after a warm-up of a few seconds they return in a few hundred milliseconds on average, can be made on demand for any action, and Google Play handles protection against replay attacks. Bind them to the action with the requestHash field, a digest of the relevant request values. Classic requests are the original method: a few seconds per call, more data and battery, and you protect them yourself with a nonce checked on your server, so keep them for rare, high-value actions. Google advises against caching a classic verdict for later; make a standard request instead. Both return the same verdict format.

Every app calling the API needs a Google Cloud project. In Play Console, open your app, go to Protected with Play, choose Get started next to Play Integrity API and click Link Cloud project; the API is enabled on the project automatically. Linking is what makes you eligible for optional verdicts and a higher daily quota. Test devices that fail device integrity usually need the factory ROM and a locked bootloader, and Play Console lets you create Play Integrity API tests.

Google’s advice is to use the verdicts as one signal in an anti-abuse strategy, not as the only one, and to start without enforcement: collect the verdicts your current users return, estimate who a rule would block, then enforce. Ask for a verdict as close as possible to the action you are protecting, and consider a tiered response, for example allowing reading on a basic device but requiring device integrity for payments or rewards. The API works on phones, tablets, foldables, Android Auto, Android TV, Android XR, ChromeOS, Wear OS and Google Play Games for PC.

Protecting the app keeps the numbers honest; being found is the rest. Censuus ranks apps by the visits they draw, and adding your app is free on the List my app form. Placement comes from traffic and sponsorship: apps climb on the visits they draw, and a sponsor can pay to rise higher.