8

When setting restriction to an API key the Attestation API stops working: OnFailureListener gets fired with the CANCELLED(16) status code

The restrictions are the android package name and the certificate signature(SHA-1)

enter image description here

Does the SafetyNet Attestation API support restricted API keys ?

Note: the same API key with the additional restriction works fine with Google Maps API

UPDATE: On devices running Google Play Services v13.0 and above, the SafetyNet Attestation API also supports app-restricted API keys. https://developer.android.com/training/safetynet/attestation

Community
  • 1
  • 1
Mickey Tin
  • 3,408
  • 10
  • 42
  • 71
  • You may refer with this [thread](https://stackoverflow.com/questions/47068393/safety-environment-check-in-android-using-safetynet-attestation-api-is-not-worki). You might be restricting the key to the wrong package name. Try to recheck the API key or create a new one like in this [page](https://developer.android.com/training/safetynet/attestation.html#add-api-key). – abielita Apr 26 '18 at 15:52
  • @abielita, double checked the package name and created the new one - still doesn't work. Also that key works fine with the Maps API – Mickey Tin May 02 '18 at 21:42
  • A quick question, Did you enable the service ? – TheLittleNaruto May 15 '18 at 08:29
  • What are all the restrictions you're using? –  May 15 '18 at 08:30
  • 1
    @TheLittleNaruto, yes the service is enabled and everything works without the restrictions – Mickey Tin May 15 '18 at 09:57
  • 1
    @YvetteColomb, the restrictions I'm using are the package name and the hash of the certificate which was used to sign the apk, I didn't set the API restriction – Mickey Tin May 15 '18 at 09:58
  • Just wild guessing it works on release but not on debug? – rekire May 15 '18 at 10:46
  • @rekire neither debug nor release works for me – Mickey Tin May 15 '18 at 11:54
  • Can you add a code snip it how you implemented that? – rekire May 15 '18 at 12:22
  • @rekire I tried it with the official sample and the behavior is the same https://github.com/googlesamples/android-play-safetynet/blob/master/client/java/SafetyNetSample/Application/src/main/java/com/example/android/safetynetsample/SafetyNetSampleFragment.java – Mickey Tin May 15 '18 at 15:29

1 Answers1

4

I've contacted a friend of mine at Google, and he reached out to their team. This is currently not supported - there's no way to get this API restricted with the SHA1 fingerprint. It's on their internal roadmap to accommodate this, but for now it won't work.

If you go to their quota request page you can see that they specifically say not to use any form of API key restrictions.

Carl Anderson
  • 3,446
  • 1
  • 25
  • 45