Setup

This page explains how to set up your app, game or SDK to use the Play Integrity API. To integrate the API, you must have a Google Cloud project, which is necessary to begin making requests. You can then link your Google Cloud project in the Google Play Console (for apps) or the Google Play SDK Console (for SDKs). Linking your project is required to access additional configuration options, testing features, API reporting, and to request an increase to your daily request quota.

Enable Play Integrity API

Every app or SDK calling the Play Integrity API must have a Google Cloud project to use the API and monitor usage. This is the mandatory first step for all integrations. You can enable the Play Integrity API in the Google Cloud Console or you can skip directly to linking your Cloud project to Google Play and Play Integrity API will be enabled for you.

In your Google Cloud Console, create a new Cloud project or choose an existing Cloud project that you want to use with the Play Integrity API.

1. Navigate to APIs and services.
2. Select Enable APIs and services.
3. Search for Play Integrity API.
4. Click Enable.

You can now integrate the Play Integrity API into your app. To access advanced features and quota increases, you must proceed to the linking step.

Link to Google Play (recommended)

Link your app or SDK to Google Play using these instructions.

For apps and games on Google Play

Apps distributed on Google Play should link their Google Cloud project in the Google Play Console to enable additional features and request increased daily API quota.

1. Open the Google Play Console and select your app.
2. Navigate to Test and release > App integrity.
3. Under Play Integrity API click Link a Cloud project.
4. Choose the Google Cloud project you plan to use with the Play Integrity API; if the Play Integrity API is not already enabled for the project, it will be enabled automatically upon linking.

For SDK providers on Play SDK Console

SDK providers using the Google Play SDK Console can link their Google Cloud project to attribute API usage to the SDK rather than the individual apps using it, enable additional features, and request increased daily API quota. Note that access to the Google Play SDK Console is subject to eligibility criteria.

1. Open the Google Play SDK Console and select your SDK.
2. Navigate to SDK integrity
3. Under Play Integrity API click Link a Cloud project.
4. Choose the Google Cloud project you plan to use with the Play Integrity API; if the Play Integrity API is not already enabled for the project, it will be enabled automatically upon linking.

Understand Play Integrity API usage limits

Your app or SDK has a default daily limit of 10,000 total requests, tied to the associated Cloud Project Number. If you anticipate a higher volume, you can request a quota increase.

Increase your daily maximum number of requests

Quota increase is subject to eligibility criteria. Quota increases apply to both client-side token generation and server-side decryption calls. Processing requests can take up to a week. We recommend monitoring your Play Integrity API usage in your Google Cloud Console and setting quota alerts to avoid interruptions to your service.

Even with higher quota, continue to limit classic requests to infrequent, high-value actions to preserve user battery and data usage.

For apps and games on Google Play

To be eligible for a quota increase, your app must be available on Google Play in addition to any other distribution channels. You must link your Google Cloud project to your app in the Play Console. Quota requests from unlinked projects will be rejected.

To request an increase:

1. Link the relevant Google Cloud project in the Play Console.
2. Verify you have correctly implemented API logic including proper retry strategies.
3. Submit the quota request form.

For SDK providers on Play SDK Console

To be eligible for a quota increase, your SDK must be claimed on the Google Play SDK Console and your Cloud project must be linked to your SDK there. Access to the Google Play SDK Console is subject to eligibility criteria.

To request an increase:

1. Link your Google Cloud project in the Google Play SDK Console.
2. Complete the Google Play SDK Console support form.

In the open comments section, describe your use case, the type of API requests that you're making (standard or classic or both), how often you're making requests, and the daily maximum requests that you want.

Integrate Play Integrity API into your app

To integrate the Play Integrity API into your app or SDK, do one of the following depending on your development environment:

Kotlin or Java

The latest Android library for the Play Integrity API is available from Google's Maven Repository. Add the following dependency to your app's build.gradle file:

implementation 'com.google.android.play:integrity:1.6.0'

Unity

The following sections describe how to integrate and set up the Google Play Integrity API for Unity projects, covering supported Unity versions, installation methods, and environment setup.

Supported Unity versions

• All versions of 2019.x, 2020.x, and newer are supported.
• If you use Unity 2018.x, version 2018.4 or newer are supported.
• Unity 2017.x and older aren't supported.

Set up your development environment

openupm add com.google.play.integrity

Unreal Engine

The following sections describe how to integrate and set up the Google Play Integrity API for Unreal Engine projects.

Supported Unreal Engine versions

The plugin supports Unreal Engine 5.0 and all subsequent versions.

Set up your development environment

1. Download the Play Unreal Engine Plugin from the GitHub repository.

2. Copy the GooglePlay folder inside your Plugins folder in your Unreal Engine project.

3. Open your Unreal Engine project and click Edit → Plugins.

4. Search for Google Play and check the Enabled checkbox.

5. Restart the game project and trigger a build.

6. Open your project's Build.cs file and add the PlayIntegrity module to PublicDependencyModuleNames:

   using UnrealBuildTool;
   
   public class MyGame : ModuleRules
   {
     public MyGame(ReadOnlyTargetRules Target) : base(Target)
     {
       // ...
   
       PublicDependencyModuleNames.Add("PlayIntegrity");
   
       // ...
     }
   }
   

Native

Follow the native setup guide. For more details, see Play Integrity's native API reference documentation.

Configure API responses (optional)

The API response includes default verdicts returned in every request. If you have linked your Cloud project in the Play Console or Play SDK Console, you can customize your API response to include additional information.

Default integrity verdicts

The following integrity verdicts are returned in the Play Integrity API response by default:

Google Play Games for PC

If you distribute to Google Play Games for PC, you will automatically be opted in to receive an additional label in the device integrity verdict:

Optional integrity verdicts

If you have linked your Cloud project in the Play Console or Play SDK Console, you can opt in to receive additional information.

To make changes, visit the Play Console and navigate to Test and release > App integrity. Next to Play Integrity API click Settings. Click Change responses, edit and save your changes.

Device information

Additional device labels in the deviceIntegrity verdict tell you more about the device environment the app is running on. A single device returns multiple labels if it meets the criteria for each. You can use these labels to create a tiered enforcement strategy. For example, you might choose to trust a device that returns three labels (MEETS_STRONG_INTEGRITY, MEETS_DEVICE_INTEGRITY, and MEETS_BASIC_INTEGRITY) more than a device that returns only one label (MEETS_BASIC_INTEGRITY).

Device attributes tells you the Android SDK version of the Android OS on the device. In the future, it may be extended with other device attributes.

Recent device activity returns a level ranging from LEVEL_1 (low number of requests) to LEVEL_4 (high number of requests). High activity levels may indicate a device being used to generate excessive tokens for abusive distribution to untrusted devices.

Device recall lets you store some custom, per-device data with specific devices that you can reliably retrieve when your app is installed again later on the same device.

After you opt in to optional information, your API response will include new fields and responses in the verdict:

Environment details

App access risk tells you whether other apps are running that could be used to capture the screen, display overlays, or control the device. Verified accessibility services that are known to Google Play are automatically excluded from this verdict.

Play Protect verdict tells you whether Google Play Protect is enabled on the device and whether it has found known malware.

After you opt in to optional information, your API response will include new fields and responses in the verdict:

Configure classic request settings (optional)

Skip this section if you only plan to make standard API requests.

By default, Google Play manages response encryption, meaning your backend calls Google's server to decrypt verdicts. Alternatively, you can manage keys yourself to decrypt locally within your secure server environment.

Let Google manage your response encryption (recommended)

We recommend allowing Google to generate and manage keys to protect your app's security. Your backend will call Google Play's server to decrypt and verify responses.

Manage your own encryption keys

To decrypt locally within your own secure server environment, you can download encryption keys from the Play Console or the Play SDK Console. Your app must be available on Google Play to use this feature.

Before you change your response encryption management strategy in the Play Console, make sure your server is correctly configured to decrypt and verify integrity tokens on Google Play's servers to avoid disruption.

Switch between Google-managed and self-managed encryption keys

1. Open the Play Console and select your app .
2. Go to Test and release > App integrity.
3. Next to Play Integrity API, click Settings.
4. Under Classic requests, next to Response encryption, click Edit.

To switch to self-managed keys:

1. Select Manage and download my response encryption keys and upload your public key.
2. Click Save to automatically download your encrypted keys.
3. Update your secure backend server to decrypt locally using these keys.

To switch to Google-managed keys:

1. Select Let Google manage my response encryption (recommended).
2. Click Save changes.