---
title: "POST /v1/projects/{projectsId}/apps/{appsId}:generatePlayIntegrityChallenge"
method: POST
path: "/v1/projects/{projectsId}/apps/{appsId}:generatePlayIntegrityChallenge"
tags: ["projects"]
---

# POST /v1/projects/{projectsId}/apps/{appsId}:generatePlayIntegrityChallenge

`POST /v1/projects/{projectsId}/apps/{appsId}:generatePlayIntegrityChallenge`

## Request

- Base URL: `https://firebaseappcheck.googleapis.com`
- URL: `https://firebaseappcheck.googleapis.com/v1/projects/{projectsId}/apps/{appsId}:generatePlayIntegrityChallenge`
- Auth: one of:
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/cloud-platform`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/cloud-platform`
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/firebase`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/firebase`

Generates a challenge that protects the integrity of an immediately following integrity verdict request to the Play Integrity API. The next call to ExchangePlayIntegrityToken using the resulting integrity token will verify the presence and validity of the challenge. A challenge should not be reused for multiple calls.

## Path parameters

- `projectsId` string, required
- `appsId` string, required

## Request body

- GoogleFirebaseAppcheckV1GeneratePlayIntegrityChallengeRequest: Request message for the GeneratePlayIntegrityChallenge method.

## Response `200`

Successful response

- GoogleFirebaseAppcheckV1GeneratePlayIntegrityChallengeResponse: Response message for the GeneratePlayIntegrityChallenge method.
  - `challenge` string: A one-time use [challenge](https://developer.android.com/google/play/integrity/verdict#protect-against-replay-attacks) for the client to pass to the Play Integrity API.
  - `ttl` string, google-duration: The duration from the time this challenge is minted until its expiration. This field is intended to ease client-side token management, since the client may have clock skew, but is still able to accurately measure a duration.

## Changes

- **2026-11-02** `c29fb33abe91`: 4 info
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2c`
  - the security scope `https://www.googleapis.com/auth/firebase` was removed from the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/firebase` was removed from the endpoint's security scheme `Oauth2c`

[Operation history](https://skmtc.dev/google/apis/firebaseappcheck/changes/v1/projects/:projectsId/apps/:appsId:generatePlayIntegrityChallenge/post.md)

---

[API](https://skmtc.dev/google/apis/firebaseappcheck.md) - [All operations](https://skmtc.dev/google/apis/firebaseappcheck/llms.txt) - [OpenAPI document](https://skmtc.dev/google/apis/firebaseappcheck/revisions/c29fb33abe91?raw)