---
title: "POST /v1/oauthClients/{oauthClientsId}:generateAppAttestChallenge"
method: POST
path: "/v1/oauthClients/{oauthClientsId}:generateAppAttestChallenge"
tags: ["oauthClients"]
---

# POST /v1/oauthClients/{oauthClientsId}:generateAppAttestChallenge

`POST /v1/oauthClients/{oauthClientsId}:generateAppAttestChallenge`

## Request

- Base URL: `https://firebaseappcheck.googleapis.com`
- URL: `https://firebaseappcheck.googleapis.com/v1/oauthClients/{oauthClientsId}:generateAppAttestChallenge`
- Auth: one of:
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/cloud-platform`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/cloud-platform`
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/firebase`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/firebase`

Generates a challenge that protects the integrity of an immediately following call to ExchangeAppAttestAttestation or ExchangeAppAttestAssertion. A challenge should not be reused for multiple calls.

## Path parameters

- `oauthClientsId` string, required

## Request body

- GoogleFirebaseAppcheckV1GenerateAppAttestChallengeRequest: Request message for the GenerateAppAttestChallenge method.

## Response `200`

Successful response

- GoogleFirebaseAppcheckV1GenerateAppAttestChallengeResponse: Response message for the GenerateAppAttestChallenge method.
  - `challenge` string, byte: A one-time use challenge for the client to pass to the App Attest API.
  - `ttl` string, google-duration: The duration from the time this challenge is minted until its expiration. This field is intended to ease client-side token management, since the client may have clock skew, but is still able to accurately measure a duration.

## Changes

- **2026-11-02** `c29fb33abe91`: 4 info
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2c`
  - the security scope `https://www.googleapis.com/auth/firebase` was removed from the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/firebase` was removed from the endpoint's security scheme `Oauth2c`

[Operation history](https://skmtc.dev/google/apis/firebaseappcheck/changes/v1/oauthClients/:oauthClientsId:generateAppAttestChallenge/post.md)

---

[API](https://skmtc.dev/google/apis/firebaseappcheck.md) - [All operations](https://skmtc.dev/google/apis/firebaseappcheck/llms.txt) - [OpenAPI document](https://skmtc.dev/google/apis/firebaseappcheck/revisions/c29fb33abe91?raw)