---
title: "POST /v1/projects/{projectsId}/apps/{appsId}:exchangeAppAttestAttestation"
method: POST
path: "/v1/projects/{projectsId}/apps/{appsId}:exchangeAppAttestAttestation"
tags: ["projects"]
---

# POST /v1/projects/{projectsId}/apps/{appsId}:exchangeAppAttestAttestation

`POST /v1/projects/{projectsId}/apps/{appsId}:exchangeAppAttestAttestation`

## Request

- Base URL: `https://firebaseappcheck.googleapis.com`
- URL: `https://firebaseappcheck.googleapis.com/v1/projects/{projectsId}/apps/{appsId}:exchangeAppAttestAttestation`
- Auth: one of:
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/cloud-platform`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/cloud-platform`
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/firebase`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/firebase`

Accepts an App Attest CBOR attestation and verifies it with Apple using your preconfigured team and bundle IDs. If valid, returns an attestation artifact that can later be exchanged for an AppCheckToken using ExchangeAppAttestAssertion. For convenience and performance, this method's response object will also contain an AppCheckToken (if the verification is successful).

## Path parameters

- `projectsId` string, required
- `appsId` string, required

## Request body

- GoogleFirebaseAppcheckV1ExchangeAppAttestAttestationRequest: Request message for the ExchangeAppAttestAttestation method.
  - `attestationStatement` string, byte: Required. The App Attest statement returned by the client-side App Attest API. This is a base64url encoded CBOR object in the JSON response.
  - `challenge` string, byte: Required. A one-time challenge returned by an immediately prior call to GenerateAppAttestChallenge.
  - `keyId` string, byte: Required. The key ID generated by App Attest for the client app.
  - `limitedUse` boolean: Specifies whether this attestation is for use in a *limited use* (`true`) or *session based* (`false`) context. To enable this attestation to be used with the *replay protection* feature, set this to `true`. The default value is `false`.

## Response `200`

Successful response

- GoogleFirebaseAppcheckV1ExchangeAppAttestAttestationResponse: Response message for the ExchangeAppAttestAttestation method.
  - `appCheckToken` GoogleFirebaseAppcheckV1AppCheckToken: Encapsulates an *App Check token*, which are used to access backend services protected by App Check.
    - `token` string: The App Check token. App Check tokens are signed [JWTs](https://www.rfc-editor.org/info/rfc7519/) containing claims that identify the attested app and GCP project. This token is used to access Google services protected by App Check. These tokens can also be [verified by your own custom backends](https://firebase.google.com/docs/app-check/custom-resource-backend) using the Firebase Admin SDK or third-party libraries.
    - `ttl` string, google-duration: The duration from the time this token is minted until its expiration. This field is intended to ease client-side token management, since the client may have clock skew, but is still able to accurately measure a duration.
  - `artifact` string, byte: An artifact that can be used in future calls to ExchangeAppAttestAssertion.

## Changes

- **2026-11-02** `c29fb33abe91`: 4 info
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2c`
  - the security scope `https://www.googleapis.com/auth/firebase` was removed from the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/firebase` was removed from the endpoint's security scheme `Oauth2c`

[Operation history](https://skmtc.dev/google/apis/firebaseappcheck/changes/v1/projects/:projectsId/apps/:appsId:exchangeAppAttestAttestation/post.md)

---

[API](https://skmtc.dev/google/apis/firebaseappcheck.md) - [All operations](https://skmtc.dev/google/apis/firebaseappcheck/llms.txt) - [OpenAPI document](https://skmtc.dev/google/apis/firebaseappcheck/revisions/c29fb33abe91?raw)