Why did SafetyNet Attestation stop working?

Question

I have an app which has been using the SafetyNet Attestation API for some time.

All of a sudden, all calls to the API started failing. Did something happen to the SafetyNet Attestation API?

Answer 1

As mentioned in the documentation and Google's checklist for SafetyNet Attestation integration, it is now mandatory to use an API key to use the SafetyNet Attestation API.

Previously, it was possible to use the SafetyNet Attestation API without an API key, and you would get a default quota (not specifically assigned to your project). This default quota is now deprecated.

The usage of the shared quota unnecessarily exposed your traffic to project-specific throttling and may have caused errors for other users of the API.

Around April 2018, Google started blocking new users of the SafetyNet Attestation API (as identified by the application's package name) from using this default quota.

Most existing clients now use API keys, but if your project doesn't, all unauthorized traffic without an API key started failing permanently from August 1, 2018.

If you were using the SafetyNet Attestation API without a key, you must now use a key. The good news is that doing so is free, and it's very easy!

Answer 2

From SafetyNet Attestation API

In order to call the methods within the SafetyNet Attestation API, you must pass in an API key. To create this key, complete the following steps:

• Go to the Library page in the Google APIs Console.
• Search for the Android Device Verification API. When you've found the API, click on it. The Android Device Verification API dashboard screen appears.
• If the API isn't already enabled, click Enable.
• If the Create credentials button appears, click on it to generate an API key. Otherwise, click the All API credentials drop-down list and select the API key that is associated with the project for which the Android Device Verification API is enabled.
• In the sidebar on the left, click Credentials. Copy the API key that appears.

Use this API key whenever you call the attest() method of the SafetyNetClient class.

After reviewing all the relevant documentation for this API—including best practices—estimate the number of calls your app might make to the API. If you need to make more than 10,000 requests per day across all API keys in your project, fill out this quota request form.