---
title: "POST /v1/oauthClients/{oauthClientsId}:exchangeAppAttestAssertion"
method: POST
path: "/v1/oauthClients/{oauthClientsId}:exchangeAppAttestAssertion"
tags: ["oauthClients"]
---

# POST /v1/oauthClients/{oauthClientsId}:exchangeAppAttestAssertion

`POST /v1/oauthClients/{oauthClientsId}:exchangeAppAttestAssertion`

## Request

- Base URL: `https://firebaseappcheck.googleapis.com`
- URL: `https://firebaseappcheck.googleapis.com/v1/oauthClients/{oauthClientsId}:exchangeAppAttestAssertion`
- Auth: one of:
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/cloud-platform`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/cloud-platform`
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/firebase`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/firebase`

Accepts an App Attest assertion and an artifact previously obtained from ExchangeAppAttestAttestation and verifies those with Apple. If valid, returns an AppCheckToken.

## Path parameters

- `oauthClientsId` string, required

## Request body

- GoogleFirebaseAppcheckV1ExchangeAppAttestAssertionRequest: Request message for the ExchangeAppAttestAssertion method.
  - `artifact` string, byte: Required. The artifact returned by a previous call to ExchangeAppAttestAttestation.
  - `assertion` string, byte: Required. The CBOR-encoded assertion returned by the client-side App Attest API.
  - `challenge` string, byte: Required. A one-time challenge returned by an immediately prior call to GenerateAppAttestChallenge.
  - `limitedUse` boolean: Specifies whether this attestation is for use in a *limited use* (`true`) or *session based* (`false`) context. To enable this attestation to be used with the *replay protection* feature, set this to `true`. The default value is `false`.

## Response `200`

Successful response

- GoogleFirebaseAppcheckV1AppCheckToken: Encapsulates an *App Check token*, which are used to access backend services protected by App Check.
  - `token` string: The App Check token. App Check tokens are signed [JWTs](https://www.rfc-editor.org/info/rfc7519/) containing claims that identify the attested app and GCP project. This token is used to access Google services protected by App Check. These tokens can also be [verified by your own custom backends](https://firebase.google.com/docs/app-check/custom-resource-backend) using the Firebase Admin SDK or third-party libraries.
  - `ttl` string, google-duration: The duration from the time this token is minted until its expiration. This field is intended to ease client-side token management, since the client may have clock skew, but is still able to accurately measure a duration.

## Changes

- **2026-11-02** `c29fb33abe91`: 4 info
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2c`
  - the security scope `https://www.googleapis.com/auth/firebase` was removed from the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/firebase` was removed from the endpoint's security scheme `Oauth2c`

[Operation history](https://skmtc.dev/google/apis/firebaseappcheck/changes/v1/oauthClients/:oauthClientsId:exchangeAppAttestAssertion/post.md)

---

[API](https://skmtc.dev/google/apis/firebaseappcheck.md) - [All operations](https://skmtc.dev/google/apis/firebaseappcheck/llms.txt) - [OpenAPI document](https://skmtc.dev/google/apis/firebaseappcheck/revisions/c29fb33abe91?raw)