How to use the Play Integrity API in your Unity game

What is the Play Integrity API?

• Is this your app? Is the package and signing certificate the one Google Play distributed?
• Is this a real device? Is it a genuine, certified Android device, or a rooted phone or a failing emulator?
• Did the player get it from Google Play? Is the user account licensed for your game?

What the verdict tells you

Takeaway: The verdict answers "is this my unmodified game, on a real device, installed from Play?" Your server decides what to do with the answer.

How to set up Play Integrity

1. Open the Google Cloud Console (opens in a new tab), create or pick a project, and enable the Play Integrity API.
2. In the Play Console, open your game, go to Protected with Play, and next to Play Integrity API click Link Cloud project. You need this link for the optional verdicts, testing tools, and a higher quota.
3. Write down the Cloud project number. Unity needs it.
4. In that Cloud project, create a service account for your backend. Your server uses it to decrypt tokens.

How to use Play Integrity in Unity

using System;
using System.Collections;
using System.Security.Cryptography;
using System.Text;
using Google.Play.Integrity;
using UnityEngine;

public class IntegrityClient : MonoBehaviour
{
    [SerializeField] private long cloudProjectNumber;
    private StandardIntegrityManagerV2.StandardIntegrityTokenProvider provider;

    private IEnumerator Start()
    {
        var manager = new StandardIntegrityManagerV2();
        var prepare = manager.PrepareIntegrityToken(
            new PrepareIntegrityTokenRequest(cloudProjectNumber));
        yield return prepare;

        if (prepare.Error != null && prepare.Error.ErrorCode != StandardIntegrityErrorCode.NoError)
        {
            Debug.LogWarning("Integrity warm-up failed: " + prepare.Error.ErrorCode);
            yield break;
        }
        provider = prepare.GetResult();
    }

    public IEnumerator SubmitScore(string playerId, int score)
    {
        string body = $"{playerId}|{score}";
        string requestHash = Hash(body);

        var request = provider.Request(new StandardIntegrityTokenRequest(requestHash));
        yield return request;

        if (request.Error != null && request.Error.ErrorCode != StandardIntegrityErrorCode.NoError)
        {
            yield break; // Retry, or send without a token and let the server decide.
        }

        string token = request.GetResult().Token;
        // Send body + token to your backend with UnityWebRequest.
    }

    private static string Hash(string text)
    {
        using var sha = SHA256.Create();
        return Convert.ToBase64String(sha.ComputeHash(Encoding.UTF8.GetBytes(text)));
    }
}

How to verify the token on your server

var credential = GoogleCredential.FromFile("service-account.json")
    .CreateScoped(PlayIntegrityService.Scope.Playintegrity);
var service = new PlayIntegrityService(new BaseClientService.Initializer
{
    HttpClientInitializer = credential
});

var response = await service.V1.DecodeIntegrityToken(
    new DecodeIntegrityTokenRequest { IntegrityToken = token },
    "com.yourstudio.yourgame").ExecuteAsync();

var payload = response.TokenPayloadExternal;
bool sameRequest = payload.RequestDetails.RequestHash == Hash(body);
bool realApp = payload.AppIntegrity.AppRecognitionVerdict == "PLAY_RECOGNIZED";
bool realDevice = payload.DeviceIntegrity.DeviceRecognitionVerdict?
    .Contains("MEETS_DEVICE_INTEGRITY") == true;

Why Play Integrity helps your game

Takeaway: Play Integrity tells your server whether to trust the client. Pair it with server-side validation and client-side protection, and you close the cheapest attack paths.

Conclusion