Google Play Integrity Token解码报URL not found问题排查

问题现象 #

参照接入指引完成Integrity Token获取、解码逻辑开发后，三类场景表现存在差异：

• 连接电脑调试的物理设备运行DEBUG版本时，可正常从服务端获取正确解码响应，返回appLicensingVerdict为LICENSED、appRecognitionVerdict为UNRECOGNIZED_VERSION，具体响应如下：

{DecodeIntegrityTokenResponse@11016}  size = 1
 "tokenPayloadExternal" -> {TokenPayloadExternal@11044}  size = 4
 key = "tokenPayloadExternal"
 value = {TokenPayloadExternal@11044}  size = 4
       "accountDetails" -> {AccountDetails@11052}  size = 1
          key = "accountDetails"
          value = {AccountDetails@11052}  size = 1
             "appLicensingVerdict" -> "LICENSED"
       "appIntegrity" -> {AppIntegrity@11054}  size = 4
          key = "appIntegrity"
          value = {AppIntegrity@11054}  size = 4
             "appRecognitionVerdict" -> "UNRECOGNIZED_VERSION"
             "certificateSha256Digest" -> {ArrayList@11072}  size = 1
             "packageName" -> "com.package.name"
             "versionCode" -> {Long@11076} 30707
       "deviceIntegrity" -> {DeviceIntegrity@11056}  size = 1
          key = "deviceIntegrity"
          value = {DeviceIntegrity@11056}  size = 1
             "deviceRecognitionVerdict" -> {ArrayList@11081}  size = 1
             key = "deviceRecognitionVerdict"
                value = {ArrayList@11081}  size = 1
                0 = "MEETS_DEVICE_INTEGRITY"
       "requestDetails" -> {RequestDetails@11058}  size = 3
          key = "requestDetails"
          value = {RequestDetails@11058}  size = 3
             "nonce" -> "my-nonce"
             "requestPackageName" -> "com.visacsoft.customcalc"
             "timestampMillis" -> {Long@11094} 1654386755670

• 开启测试组校验的RELEASE版本从Google Play下载到物理设备运行时，可正常获取正确解码响应，返回appLicensingVerdict为LICENSED、appRecognitionVerdict为PLAY_RECOGNIZED，具体响应如下：

{DecodeIntegrityTokenResponse@23464}  size = 1
   "tokenPayloadExternal" -> {TokenPayloadExternal@23474}  size = 5
      key = "tokenPayloadExternal"
      value = {TokenPayloadExternal@23474}  size = 5
      "accountDetails" -> {AccountDetails@23483}  size = 1
         key = "accountDetails"
         value = {AccountDetails@23483}  size = 1
            "appLicensingVerdict" -> "LICENSED"
      "appIntegrity" -> {AppIntegrity@23485}  size = 4
         key = "appIntegrity"
         value = {AppIntegrity@23485}  size = 4
         "appRecognitionVerdict" -> "PLAY_RECOGNIZED"
            key = "appRecognitionVerdict"
            value = "PLAY_RECOGNIZED"
         "certificateSha256Digest" -> {ArrayList@23505}  size = 1
            key = "certificateSha256Digest"
            value = {ArrayList@23505}  size = 1
            0 = "012345678901234567890b1mYS6Y6rQ4gFUw"
         "packageName" -> "com.package.name"
            key = "packageName"
            value = "com.package.name"
         "versionCode" -> {Long@23509} 30707
            key = "versionCode"
            value = {Long@23509} 30707
      "deviceIntegrity" -> {DeviceIntegrity@23487}  size = 1
         key = "deviceIntegrity"
         value = {DeviceIntegrity@23487}  size = 1
            "deviceRecognitionVerdict" -> {ArrayList@23516}  size = 1
               key = "deviceRecognitionVerdict"
               value = {ArrayList@23516}  size = 1
                  0 = "MEETS_DEVICE_INTEGRITY"
      "requestDetails" -> {RequestDetails@23489}  size = 3
         key = "requestDetails"
         value = {RequestDetails@23489}  size = 3
            "nonce" -> "my-nonce"
               key = "nonce"
               value = "my-nonce"
            "requestPackageName" -> "com.package.name"
            "timestampMillis" -> {Long@23529} 1654368020674

• 移除测试组配置后，完全相同的RELEASE版本从Google Play下载运行时，返回HTML格式错误提示：

The requested URL /v1/:decode IntegrityToken? B=com.package.name was not found on this server.

已逐一排查Google Play Console、Google Cloud控制台相关配置，尝试配置/移除IntegrityTokenResponse关联的云项目编号，均会复现该错误。

问题根因 #

DEBUG版本、加入测试组的RELEASE版本调用接口时，默认走Google提供的沙箱测试环境端点，不需要生产环境的服务授权、配额校验，因此可正常返回结果。移除测试组后，正式版应用会自动切换到生产环境API端点，此时如果生产侧配置缺失，就会触发接口404错误。
返回错误中decode与IntegrityToken之间的多余空格，是旧版Play Integrity SDK的已知bug，会在生产环境鉴权失败时触发异常URL拼接逻辑，不属于手动传参错误。

修复步骤 #

• 完成Play Console与Google Cloud项目的正式绑定
  进入Play Console对应应用的「应用完整性」设置页，在Play Integrity API关联项目选项中，选择目标Google Cloud项目，确认关联状态为「已连接」，不要使用默认自动创建的临时测试项目。确认操作账号拥有对应Cloud项目的所有者/API管理员权限，关联完成后等待15-30分钟待配置全局生效。
• 在Google Cloud控制台正式启用Play Integrity API生产服务
  进入对应Cloud项目的API库页面，找到Google Play Integrity API并点击「启用」，不要停留在测试启用状态。进入API的「配额」页面，确认生产环境每日调用配额不为0，新启用的API默认提供基础免费配额。
• 升级客户端Play Integrity SDK到最新稳定版
  1.0.x及更早预览版SDK存在生产环境接口URL拼接错误的问题，升级到最新正式版SDK后重新编译RELEASE包上传。新包需要发布到正式轨道，不要仅停留在内部测试/封闭测试轨道，发布完成后等待2-3小时待Play商店侧的应用签名信息同步完成。
• 校验服务端解码逻辑
  确认服务端调用解码接口时使用正式生产端点，不要硬编码测试环境地址；确认服务端请求携带的凭证拥有Play Integrity API调用权限，对应的服务账号需要提前在Cloud控制台授予「Play Integrity API 调用者」角色。

验证方式 #

所有配置生效后，卸载设备上原有测试版本应用，从Play商店正式轨道重新下载安装RELEASE版本，即可正常获取解码响应，不会再出现URL 404错误。

内容的提问来源于stack exchange，提问作者pvalle