🐛 [Firebase_Auth] reCaptcha page pops even though play integrity configured

[lironzemingo]

I have added Firebase auth to my app, configured AppCheck with Play integrity, added SHA-1 in Settings, added my SHA-256 (in Firebase console -> settings, and also under Play Integrity), and also my debug token. this code runs before runApp :

WidgetsFlutterBinding.ensureInitialized(); await Firebase.initializeApp(); await FirebaseAppCheck.instance.activate( webRecaptchaSiteKey: 'recaptcha-v3-site-key', androidProvider: _isDevEnvironment() ? AndroidProvider.debug : AndroidProvider.playIntegrity, ); I expect not to see the reCaptch page when calling firebaseAuth.verifyPhoneNumber(...)but I still see the reCaptcha screen. What am I missing? followed every instruction in the documents.

Pubspec: `name: XXX description: A new Flutter project.

publish_to: 'none' # Remove this line if you wish to publish to pub.dev version: 0.1.0+1

environment: sdk: '>=2.19.2 <3.0.0'

dependencies: flutter: sdk: flutter

bloc: ^8.1.1 cached_network_image: ^3.2.3 country_calling_code_picker: ^2.0.1 crop_your_image: ^0.7.4 cupertino_icons: ^1.0.5 device_info_plus: ^8.1.0 dio: ^5.0.0 equatable: ^2.0.5 fimber: ^0.6.6 firebase_app_check: ^0.1.1+13 firebase_auth: ^4.2.7 firebase_core: ^2.6.0 firebase_crashlytics: ^3.0.15 firebase_performance: ^0.9.0+14 flutter_bloc: ^8.1.2 flutter_contacts: ^1.1.6 flutter_easyloading: ^3.0.5 flutter_flavor: ^3.1.1 flutter_keyboard_visibility: ^5.4.0 flutter_native_splash: ^2.2.18 flutter_secure_storage: ^8.0.0 flutter_svg: ^2.0.2 get_it: ^7.2.0 go_router: ^6.0.6 google_fonts: ^4.0.3 http_parser: ^4.0.2 image: ^4.0.15 image_picker: ^0.8.6+3 json_annotation: ^4.8.0 just_the_tooltip: ^0.0.12 path_provider: ^2.0.13 permission_handler: ^10.2.0 pinput: ^2.2.31 retrofit: ^4.0.1 get: ^4.6.5 share_plus: ^6.3.1 tap_debouncer: ^2.0.2 url_launcher: ^6.1.10

webview_flutter: ^4.0.5

dev_dependencies: flutter_test: sdk: flutter

build_runner: ^2.3.3 flutter_gen_runner: ^5.2.0 flutter_lints: ^2.0.1 json_serializable: ^6.6.1 retrofit_generator: ^5.0.0

flutter_native_splash: color: '#000000'

image: assets/images/logo_native_splash_4x.png

flutter_gen: output: lib/core/gen

integrations: flutter_svg: true

flutter:

uses-material-design: true

assets:

• assets/images/
• assets/icons/ ` Flutter doctor:

[!] Flutter (Channel stable, 3.7.3, on macOS 12.6 21G115 darwin-arm64, locale en-IL) • Flutter version 3.7.3 on channel stable at /Users/lironitzhaki/flutter ! Warning: dart on your path resolves to /usr/local/Cellar/dart/2.19.3/libexec/bin/dart, which is not inside your current Flutter SDK checkout at /Users/lironitzhaki/flutter. Consider adding /Users/lironitzhaki/flutter/bin to the front of your path. • Upstream repository https://github.com/flutter/flutter.git • Framework revision 9944297138 (5 weeks ago), 2023-02-08 15:46:04 -0800 • Engine revision 248290d6d5 • Dart version 2.19.2 • DevTools version 2.20.1 • If those were intentional, you can disregard the above warnings; however it is recommended to use "git" directly to perform update checks and upgrades.

[✓] Android toolchain - develop for Android devices (Android SDK version 32.1.0-rc1) • Android SDK at /Users/lironitzhaki/Library/Android/sdk • Platform android-33, build-tools 32.1.0-rc1 • Java binary at: /Applications/Android Studio.app/Contents/jre/Contents/Home/bin/java • Java version OpenJDK Runtime Environment (build 11.0.13+0-b1751.21-8125866) • All Android licenses accepted.

[✓] Xcode - develop for iOS and macOS (Xcode 14.2) • Xcode at /Applications/Xcode.app/Contents/Developer • Build 14C18 • CocoaPods version 1.11.3

[✓] Chrome - develop for the web • Chrome at /Applications/Google Chrome.app/Contents/MacOS/Google Chrome

[✓] Android Studio (version 2021.3) • Android Studio at /Applications/Android Studio.app/Contents • Flutter plugin can be installed from: 🔨 https://plugins.jetbrains.com/plugin/9212-flutter • Dart plugin can be installed from: 🔨 https://plugins.jetbrains.com/plugin/6351-dart • Java version OpenJDK Runtime Environment (build 11.0.13+0-b1751.21-8125866)

[✓] Connected device (3 available) • SM S908E (mobile) • R5CT3493C5J • android-arm64 • Android 13 (API 33) • macOS (desktop) • macos • darwin-arm64 • macOS 12.6 21G115 darwin-arm64 • Chrome (web) • chrome • web-javascript • Google Chrome 110.0.5481.177

[✓] HTTP Host Availability • All required HTTP hosts are available

! Doctor found issues in 1 category.

[NaosFr]

@nohe427 Thanks, I will check 👍

firebase_core: ^2.8.0 firebase_auth: ^4.4.0

[Manjunathjm]

@nohe427 Yes, I did receive the SMS successfully. However, as I mentioned earlier, it is still displaying ".firebaseapp.com" instead of the app name.

@Manjunathjm & @belh-sara

Could you send me a screenshot of the SMS message received? It should have the project name in there in front of firebaseapp.com

Feel free to DM me the screenshots on Twitter if you are uncomfortable posting here

@nohe427 Sure. attached is the screenshot of the SMS.

[VanToan08]

For more updates on falling back to recaptcha, please check our Firebase status page. Current status: Mitigation work is underway for restoring Play Integrity as the client verification mechanism.

Has there been an update for this issue?

Please check out this information here : #10593 (comment)

If you have an API Key Restriction, you could be blocking reCaptcha from successfully running since it reuses the Android key to make the requests in a different application context (browser vs your app)

If you are still unable to get SMS messages after removing key restrictions due to reCaptcha failing, please let us know.

I followed the instructions but the problem is not solved:

[NaosFr]

@nohe427 Same problem with chill-20915 😟 for android only

[nohe427]

@nohe427 Same problem with chill-20915 😟 for android only

Is this with no sms being delivered or the message containing ${PROJECT_NAME}.firebaseapp.com?

[nohe427]

@nohe427 Yes, I did receive the SMS successfully. However, as I mentioned earlier, it is still displaying ".firebaseapp.com" instead of the app name.

@Manjunathjm & @belh-sara

Could you send me a screenshot of the SMS message received? It should have the project name in there in front of firebaseapp.com Feel free to DM me the screenshots on Twitter if you are uncomfortable posting here

@nohe427 Sure. attached is the screenshot of the SMS.

This is expected behavior for reCaptcha verification. The verification message with contain ${PROJECT_NAME}.firebaseapp.com. We are working on getting Play Integrity restored. I have noted the feedback of ${PROJECT_NAME}.firebaseapp.com in the reCaptcha message

[nohe427]

For more updates on falling back to recaptcha, please check our Firebase status page. Current status: Mitigation work is underway for restoring Play Integrity as the client verification mechanism.

Has there been an update for this issue?

Please check out this information here : #10593 (comment) If you have an API Key Restriction, you could be blocking reCaptcha from successfully running since it reuses the Android key to make the requests in a different application context (browser vs your app) If you are still unable to get SMS messages after removing key restrictions due to reCaptcha failing, please let us know.

I followed the instructions but the problem is not solved:

You also followed these instructions? (https://github.com/firebase/flutterfire/issues/10593#issuecomment-1516862489) There are two things that need to be validated :

1. No restrictions on API key in google cloud console
2. The SHA1 and SHA256 signing key for the app you are running registered in the firebase console. I would double check that the app you are runnings signing keys are registered based on that error message

[hyperitycorp-jkh]

Unfortunately, there is a serious problem causing a lot of people to suffer, but it seems that the responsible party is repeatedly attributing it to developer errors and only providing basic guidelines. Most developers have already checked SHA1 and SHA256 countless times, as well as confirmed there are no API restrictions. It's not that developers are using them incorrectly, but rather, it's important to identify and analyze any issues with the libraries provided by Google so that the problem can be fixed as soon as possible.

[ridwan-aswan]

Sayangnya, ada masalah serius yang menyebabkan banyak orang menderita, namun tampaknya pihak yang bertanggung jawab berulang kali mengaitkannya dengan kesalahan pengembang dan hanya memberikan pedoman dasar. Sebagian besar pengembang telah memeriksa SHA1 dan SHA256 berkali-kali, serta memastikan tidak ada batasan API. Bukan karena pengembang salah menggunakannya, tetapi penting untuk mengidentifikasi dan menganalisis masalah apa pun dengan pustaka yang disediakan oleh Google sehingga masalah tersebut dapat diperbaiki sesegera mungkin.

Yes, you're correct. I've been waiting for almost a month for this issue to be fixed, and I sincerely hope it will be addressed promptly. The problem with SMS authentication started after the transition to Play Integrity. Developers have meticulously adhered to the documentation, repeatedly verifying the SHA-1 and SHA-256 keys, and making sure there are no API limitations. Prior to the shift to Play Integrity, everything was functioning well.

[ridwan-aswan]

@nohe427

I am unsure of what else to try. The following is an excerpt from my project configuration; however, I continue to encounter reCAPTCHA problems and a multitude of error logs, including:

[firebase_auth/missing-client-identifier] This request is missing a valid app identifier, meaning that Play Integrity checks, SafetyNet checks, and reCAPTCHA checks were unsuccessful. Please try again, or check the logcat for more details.

Additionally, the SMS OTP that arrives does not contain the application's name, making it seem as though it is still in debug mode prior to the introduction of Play Integrity.

[dangtienngoc]

@ridwan-aswan After add SHA1 and SHA256 to Firebase app. Did you re download file google-service.json and update to the project and build again?

[ridwan-aswan]

@ridwan-aswan After add SHA1 and SHA256 to Firebase app. Did you re download file google-service.json and update to the project and build again?

Yes, I re-downloaded it, even I did it many times.

[MI-Soft]

Hi, I have enabled app integrity and using latest version of firebase core ,auth and every firebase packages. and i have added project in app integrity in play console too. but when i login with phone auth , page redirects to recaptcha before getting otp. I don't the recaptcha verification. What can i do now?

[nohe427]

@MI-Soft

Hi, I have enabled app integrity and using latest version of firebase core ,auth and every firebase packages. and i have added project in app integrity in play console too. but when i login with phone auth , page redirects to recaptcha before getting otp. I don't the recaptcha verification. What can i do now?

Just to clarify, you're completing the reCaptcha?

The reCaptcha verification must be completed in order to get an SMS OTP token while play integrity is being re-enabled as the client verification method.

[nohe427]

@ridwan-aswan After add SHA1 and SHA256 to Firebase app. Did you re download file google-service.json and update to the project and build again?

Yes, I re-downloaded it, even I did it many times.

When do you get this message: [firebase_auth/missing-client-identifier] This request is missing a valid app identifier, meaning that Play Integrity checks, SafetyNet checks, and reCAPTCHA checks were unsuccessful. Please try again, or check the logcat for more details.

Is it intermittently? I see from your other message that you are still getting the otp. I'm aware of the firebaseapp.com issue and have noted that down, so I'd like to better understand when you get that error message. I found that this error message can also appear when the reCaptcha is dismissed without completing. Are there other times you are seeing this?

[Manjunathjm]

@nohe427 Yes, I did receive the SMS successfully. However, as I mentioned earlier, it is still displaying ".firebaseapp.com" instead of the app name.

@Manjunathjm & @belh-sara

Could you send me a screenshot of the SMS message received? It should have the project name in there in front of firebaseapp.com Feel free to DM me the screenshots on Twitter if you are uncomfortable posting here

@nohe427 Sure. attached is the screenshot of the SMS.

This is expected behavior for reCaptcha verification. The verification message with contain ${PROJECT_NAME}.firebaseapp.com. We are working on getting Play Integrity restored. I have noted the feedback of ${PROJECT_NAME}.firebaseapp.com in the reCaptcha message

@nohe427 The issue is not that the sms has "${PROJECT_NAME}.firebaseapp.com", the issue is that in the UX, a reCaptcha screen is shown which is redundant. After the user enters the phone number, the user is momentarily taken to a reCaptcha screen where no action is required and then it shows the screen to enter OTP. Why add an additional unnecessary screen? Hope you understood what the issue is.

[NaosFr]

Hello, any news on : https://status.firebase.google.com/incidents/UY1LTFan8X5oybhphzfV

All our problems are in this incident !

[nohe427]

@nohe427 Yes, I did receive the SMS successfully. However, as I mentioned earlier, it is still displaying ".firebaseapp.com" instead of the app name.

@Manjunathjm & @belh-sara

Could you send me a screenshot of the SMS message received? It should have the project name in there in front of firebaseapp.com Feel free to DM me the screenshots on Twitter if you are uncomfortable posting here

@nohe427 Sure. attached is the screenshot of the SMS.

This is expected behavior for reCaptcha verification. The verification message with contain ${PROJECT_NAME}.firebaseapp.com. We are working on getting Play Integrity restored. I have noted the feedback of ${PROJECT_NAME}.firebaseapp.com in the reCaptcha message

@nohe427 The issue is not that the sms has "${PROJECT_NAME}.firebaseapp.com", the issue is that in the UX, a reCaptcha screen is shown which is redundant. After the user enters the phone number, the user is momentarily taken to a reCaptcha screen where no action is required and then it shows the screen to enter OTP. Why add an additional unnecessary screen? Hope you understood what the issue is.

I think I better understand. You are trying to understand why the reCaptcha screen is shown at all since Play Integrity should be running. In this comment : https://github.com/firebase/flutterfire/issues/10593#issuecomment-1516913704 I mention that the Play Integrity verification method is being reinstated as the default provider. I see that I could have explained this better in that comment, so I will try to clarify now.

The Play Integrity service for SMS OTP authentication flows is not working, so all flows will fallback to reCaptcha. Until Play Integrity is restored as the client verification mechanism, reCaptcha will be the only working flow. This work is underway, and does take time to resolve. Checking the status page: https://status.firebase.google.com/incidents/UY1LTFan8X5oybhphzfV may alert you to when Play Integrity is resolved and restored as the default method. I hope this clarifies my previous comment about Play Integrity and the status page.

[Manjunathjm]

@nohe427 Yes, I did receive the SMS successfully. However, as I mentioned earlier, it is still displaying ".firebaseapp.com" instead of the app name.

@Manjunathjm & @belh-sara

Could you send me a screenshot of the SMS message received? It should have the project name in there in front of firebaseapp.com Feel free to DM me the screenshots on Twitter if you are uncomfortable posting here

@nohe427 Sure. attached is the screenshot of the SMS.

This is expected behavior for reCaptcha verification. The verification message with contain ${PROJECT_NAME}.firebaseapp.com. We are working on getting Play Integrity restored. I have noted the feedback of ${PROJECT_NAME}.firebaseapp.com in the reCaptcha message

@nohe427 The issue is not that the sms has "${PROJECT_NAME}.firebaseapp.com", the issue is that in the UX, a reCaptcha screen is shown which is redundant. After the user enters the phone number, the user is momentarily taken to a reCaptcha screen where no action is required and then it shows the screen to enter OTP. Why add an additional unnecessary screen? Hope you understood what the issue is.

I think I better understand. You are trying to understand why the reCaptcha screen is shown at all since Play Integrity should be running. In this comment : #10593 (comment) I mention that the Play Integrity verification method is being reinstated as the default provider. I see that I could have explained this better in that comment, so I will try to clarify now.

The Play Integrity service for SMS OTP authentication flows is not working, so all flows will fallback to reCaptcha. Until Play Integrity is restored as the client verification mechanism, reCaptcha will be the only working flow. This work is underway, and does take time to resolve. Checking the status page: https://status.firebase.google.com/incidents/UY1LTFan8X5oybhphzfV may alert you to when Play Integrity is resolved and restored as the default method. I hope this clarifies my previous comment about Play Integrity and the status page.

Thanks @nohe427 for the clarification. Appreciate it.

[nohe427]

Just got word that Play Integrity provider was reinstated as the main verification method. Please give it a try and see if you are still seeing reCaptcha on the Play deployed version of your app.

[ridwan-aswan]

Thank you! @nohe427 The SMS OTP is now functioning correctly!

[NaosFr]

Nice ✨ All is good thanks

[belh-sara]

Thank you @nohe427, the recaptcha has disappeared and the SMS OTP is now working flawlessly.

[niladri-raychaudhuri]

Working now, thanks a lot @nohe427 for the update.

[myxomatos]

Hi everyone, the Play Integrity tests have finished and the service has been completely restored. The reason you were seeing reCAPTCHA is because it is part of the Firebase Phone Auth flow when Play Integrity and SafetyNet are down the requests will be sent to reCAPTCHA to authenticate users, and that is the reason why to see the URL of the project instead of the App name, since the URL is the only thing that reCAPTCHA can verify.

In the following days, the flow will be published so that developers know about this flow and take it into account for possible future failures (I can't guarantee the date this will be published).

This would be the normal flow:

First Play Integrity, if PI fails, SafetyNet (will be deprecated soon), if SafetyNet fails, reCAPTCHA takes the place of the above.

As soon as I have the documentation I will share it with you.

[osama300]

@myxomatos Hello, my app is working on Android 13 and SMS is received with the app's name. I tested it after publishing to the Play Store, but in Android 10 or other versions, there is a problem. Why?

this request is missing a valid app identifier, meaning that play integrity checks, safetynet checks, and recaptcha checks were unsuccessful. please try again, or check the logcat for more details. OR

This app is not authorized to use Firebase Authentication. Please verify that the correct package name and SHA-1 are configured in the Firebase Console. [ A play_integrity_token was passed, but no matching SHA-256 was registered in the Firebase console. Please make sure that this application’s packageName/SHA256 pair is registered in the Firebase Console. ]

[myxomatos]

Hi @osama300, I hope you are well.

The first error: "this request is missing a valid app identifier, meaning that play integrity checks, safetynet checks, and recaptcha checks were unsuccessful. Please try again, or check the logcat for more details." seems to be related to Appcheck + Play Integrity, the recommendation is to file a case for App Check Support to review in detail.

The second message: _"A play_integritytoken was passed, but no matching SHA-256 was registered in the Firebase console" means that the app is not authorized, you have to verify 3 things that are related to this error since when verifying your application with Play Integrity if any of these elements are not specified in the Firebase Console this error will appear, please check that these parameters are registered in your Firebase project since all 3 are necessary:

1. Correct Package Name
2. Correct SHA-1
3. Correct SHA-256

Please review these data and try again, I also recommend updating the latest version of the Authentication SDK.

If the above does not work, please raise a case in the Support channel to review it in detail.

[osama300]

Hello sir @myxomatos I changed the Firebase project for my application, but then I canceled the change and returned to the previous project. Could this be the reason why my application is not working, knowing that my application was working before the Google issue and before changing the project .

I have another application that sends messages without any problems. I tried to change the application signature, but I changed the key last October, and changing the signature is allowed only once a year.

Are there any solutions?

[developerspagmani]

Hi @nohe427, This request is missing a valid app identifier, meaning that Play Integrity checks, SafetyNet checks, and reCAPTCHA checks were unsuccessful. Please try again, or check the logcat for more details. Can you some one help me out this. I did all the changes. But still I am getting this issue.

Changes are done, SHA-1 SHA-256 Enabled Play integrity service firebase_auth and firebase_core packages are up to date.

[nohe427]

@developerspagmani -

• Are you using the Play deployed version of the app?
• Did you check API key restrictions? https://github.com/firebase/flutterfire/issues/10593#issuecomment-1520911877
• Here is a guide on checking signing certs to validate that they all match. https://github.com/firebase/flutterfire/issues/10593#issuecomment-1516862489

That error message is generally when the apps certificate fingerprint differs from what is registered in the Firebase console. I would use peters asset link tool mentioned in the comment linked above to validate.

[harshanacz]

@nohe427 Can the Integrity API be used with apps that are not currently published on the Google Play Store? (I have temporarily unpublish my app from the Play Console. - approved but unpublished )

[nohe427]

@harshanacz - Play Integrity API works with apps that come from Google Play (the certificate fingerprints need to match).

[MI-Soft]

@nohe427 after publishing app to play store, i didn't get recaptcha. now it works fine. Thanks

[nohe427]

@nohe427 Asking for further clarification, If an app is approved on the Google Play Store but is temporarily unpublished, will the Integrity API still work? I want to make sure that phone auth works even when it's not available for download on the store.

I haven't tested this specific case. My assumption is if the Play Store key matches the local key, it should work. I have an internal testing channel release and I get Play Integrity running there.

[code-spartan]

Facing the same issue for one month I have completed all the steps from adding SHA fingerprints to making sure that my API key is also unrestricted.

firebase_core: ^2.10.0 firebase_auth: ^4.4.2 firebase_app_check: ^0.1.2+3

This is my current version of firebase plugins added to the project however I still run into the 17499 Internal Failure resulting in no OTP or in some vary rare instances when the app fails to fetch the Play Integrity token it falls back to the ReCaptcha webpage. The app is currently on playstore on the Internal Testing track.

[code-spartan]

@nohe427 Asking for further clarification, If an app is approved on the Google Play Store but is temporarily unpublished, will the Integrity API still work? I want to make sure that phone auth works even when it's not available for download on the store.

I haven't tested this specific case. My assumption is if the Play Store key matches the local key, it should work. I have an internal testing channel release and I get Play Integrity running there.

Can you share the versions of the Firebase plugins you are using.

[myxomatos]

Hi @nohe427 / @code-spartan, hope you doing well.

Remember that the versions that you should be running in your Android apps should be:

• App Check 17.0.0
• Authentication 22.0.0

In the Firebase Authentication SDK (22.0.0) the reCAPTCHA should not be appearing anymore, SafetyNet is been removed and Play Integrity should work always on top of reCAPTCHA. Remember that it does not mean that reCAPTCHA is never going to be there again, if someday Play Integrity fails reCAPTCHA is going to receive all calls and complete the Authentication flow.

Please if you have more doubts about this and your apps are experiencing these errors please contact the Firebase Support team.

[code-spartan]

How to use the same in flutter can you please elaborate on that. where should I make changes to make it work @myxomatos

[myxomatos]

The versions you are using for Flutter should work by now, if still experiencing that error I hardly recommend rising a case on the Firebase Support Channel so we can report it.

[nohe427]

@code-spartan - Try re-downloading the google-services.json file and place it in the Android folder. Make sure that you are also getting the app from the Google Play Store as the cert fingerprint need to match whats listed in Google Play for Play Integrity to run successfully. I have put all the troubleshooting steps in a stack overflow post here: https://stackoverflow.com/questions/76147230/why-might-i-be-seeing-a-recaptcha-when-doing-phone-auth/76149009#76149009

[myxomatos]

@code-spartan - Try re-downloading the google-services.json file and place it in the Android folder. Make sure that you are also getting the app from the Google Play Store as the cert fingerprint need to match whats listed in Google Play for Play Integrity to run successfully. I have put all the troubleshooting steps in a stack overflow post here: https://stackoverflow.com/questions/76147230/why-might-i-be-seeing-a-recaptcha-when-doing-phone-auth/76149009#76149009

That's very good advice that I missed @code-spartan, @nohe427 please update the file in your project and try again and after that, the ideal would be to report it.

[code-spartan]

I have re-downloaded and updated my google-services.json file and I also reported the issue in the Firebase support section. However, there is no change in the errors. The main issue in my case is I get no otp sms and I don't get redirected to Recaptcha. Firebase just throws error code 17499 and Firebase auth internal error occurred and no sms is sent. If I keep trying again and again the Integrity checking API reaches a throttle and then I get redirected to the recaptcha page and in most cases, I receive the otp after the recaptcha popup. I am checking on both Flutter debug mode and on the Internal Testing track app from Google Play Store in both cases, the behaviour is the same. I have seen the StackOverflow post and rechecked all the steps I have taken so far there is no miss. @nohe427 @myxomatos

[myxomatos]

@nohe427 Can the Integrity API be used with apps that are not currently published on the Google Play Store? (I have temporarily unpublish my app from the Play Console. - approved but unpublished )

Hi @nohe427. The answer is NO, if the application is not published it will not be able to use Play Integrity. Play Integrity is a Play Store service, in other words if the app is not published in the Play Store Play Integrity will not work but reCAPTCHA will enter the flow to authenticate your users but it is likely that you will receive errors like: "18002 Invalid PlayIntegrity token; app not Recognized by Play Store"

[Alexsantosjr]

Hi @myxomatos I already have my public app but it's using SafetyNet in production. I just added PLAY INTEGRITY API in my local environment in this case the recaptcha will only disappear after I upload the new version to the Play Store?

[GrandeSamarone]

@nohe427A Integrity API pode ser usada com aplicativos que não estão atualmente publicados na Google Play Store? (Eu cancelei temporariamente a publicação do meu aplicativo no Play Console. - aprovado, mas não publicado)

Oi@nohe427. A resposta é NÃO , se o aplicativo não for publicado não poderá usar o Play Integrity. O Play Integrity é um serviço da Play Store, ou seja, se o aplicativo não estiver publicado na Play Store, o Play Integrity não funcionará, mas o reCAPTCHA entrará no fluxo para autenticar seus usuários, mas é provável que você receba erros como: "18002 inválido Token PlayIntegrity; aplicativo não reconhecido pela Play Store"

IntegrityService : requestIntegrityToken(IntegrityTokenRequest{nonce=9clVsuXQ_5V6F6eiEnuVyW6GIX4tiPZyEfTxbjloGug, cloudProjectNumber=551503664846}) I/PlayCore( 5256): UID: [10834] PID: [5256] IntegrityService : Initiate binding to the service. I/PlayCore( 5256): UID: [10834] PID: [5256] IntegrityService : ServiceConnectionImpl.onServiceConnected(ComponentInfo{com.android.vending/com.google.android.finsky.integrityservice.IntegrityService}) I/PlayCore( 5256): UID: [10834] PID: [5256] IntegrityService : linkToDeath I/PlayCore( 5256): UID: [10834] PID: [5256] IntegrityService : Unbind from service. I/PlayCore( 5256): UID: [10834] PID: [5256] OnRequestIntegrityTokenCallback : onRequestIntegrityToken W/System ( 5256): Ignoring header X-Firebase-Locale because its value was null. I/System.out( 5256): [okhttp]:check permission begin! I/System.out( 5256): [okhttp]:not MMS! I/System.out( 5256): [okhttp]:not Email! I/System.out( 5256): [OkHttp] sendRequest<< E/FirebaseAuth( 5256): [SmsRetrieverHelper] SMS verification code request failed: unknown status code: 18002 Invalid PlayIntegrity token; app not Recognized by Play Store.

my flutter app that worked normally after updating is giving this error 18002, the app is still under development, how do I test the authentication before launching it in the store?

OBS: I've already used fictional numbers and even then it's timed out.

firebase_core: ^2.11.0 firebase_auth: ^4.5.0

implementation 'com.google.firebase:firebase-auth:22.0.0' implementation platform('com.google.firebase:firebase-bom:32.0.0') implementation 'com.google.firebase:firebase-appcheck-playintegrity' implementation 'com.google.firebase:firebase-appcheck-debug:16.1.2'

[IncognitoGK9]

In my case, the sms code is sent. On bottom right conner it shows a recapture dialog with tjbr term link. On the top left conrner i see a looping circular dialog, and the app fails to authenticate with tbe sent sms code. Only happens on web.

[GrandeSamarone]

do you have a demo code that works? based on it, or does the code only arrive in the app if it's in the store?

here I get the code but the app doesn't, so I can't verify

[GrandeSamarone]

https://github.com/firebase/flutterfire/assets/30990831/9d0d9999-92e5-4532-b0b8-0c4cc459bd91

[GrandeSamarone]

@nohe427 Can the Integrity API be used with apps that are not currently published on the Google Play Store? (I have temporarily unpublish my app from the Play Console. - approved but unpublished )

Hi @nohe427. The answer is NO, if the application is not published it will not be able to use Play Integrity. Play Integrity is a Play Store service, in other words if the app is not published in the Play Store Play Integrity will not work but reCAPTCHA will enter the flow to authenticate your users but it is likely that you will receive errors like: "18002 Invalid PlayIntegrity token; app not Recognized by Play Store"

Is automatic verification only possible after you are in the store?

[nohe427]

@GrandeSamarone For Play Integrity attestation to work, the app must be deployed to Google Play and subsequently downloaded from Google Play. More troubleshooting information can be found here.