ApiException: 7 error with AppCheck on Android within React Native

[fidodido75]

We have a React Native app where we have AppCheck implemented but not enforced within any of the other standard Firebase Services or Cloud functions.
It was working fine until we have added jail-monkey library and also added the app restriction for the API key (no API restriction was added). The attestation for Android is still with SafetyNet. I have checked all the keys and SHAs within Google Console and Firebase and they are all OK.
Our app started to throw the exception error below:
E/AppCheck: RNFB: Unknown error while fetching AppCheck token com.google.android.gms.common.api.ApiException: 7:
for the line:
appCheckToken = await appCheck().getToken();
This exception error is defined as a Network Error and we were advised to check the clock settings and internet settings. However, we could not get rid of it.
We have a very similar app within a very similar setting which went through the same changes (jail-monkey library added and app restriction key added to the API key), and it works just fine.
The main difference between the two apps is that the working app is enforced into our backend and uses the verification, however on the one with the error our backend doesn't validate it, it uses a header.
I don't understand why we set the appcheck without enforcing it on our backend is one question, but I don't understand why it's not working within the same the configuration.
It will be great to hear your views and also your solutions if you had an instance of this ApiException: 7.

[mikehardy]

Hi there!- with apologies I've got no experience with the jail-monkey library so reproduction from the react-native-firebase perspective should focus on not involving it for now.

You indicate that introduction of jail-monkey and app restriction for the API key was added, which is two changes at once.

It would be interesting to see a result where only one thing - the "app restriction for the API key" (what does that mean precisely?) was performed.

The main difference between the two apps is that the working app is enforced into our backend and uses the verification, however on the one with the error our backend doesn't validate it, it uses a header.

Exploring those details in more depth might be interesting. It might also be a case of "use the style that works..."

I don't understand why it's not working within the same the configuration.

I don't either! https://stackoverflow.com/help/minimal-reproducible-example - and it might be best to base it off one of the quickstarts here (adding appcheck to, perhaps, firestore or something https://github.com/firebase/quickstart-android) so that if there is an interaction it may be tracked into firebase-android-sdk as there is likely not much we can do at the react-native layer, AppCheck things are usually a bit opaque and lie beneath this module

Also, this is logged as a discussion, but it sounds like an issue. The issue template has a lot of pertinent information requested that could help troubleshoot. Without it, we can't really offer help, we can only discuss, likely without resolution

[fidodido75]

Yes you're right, I will try to log it as an issue.
By the way, I tested the app again by removing the jail-monkey and the exception error persisted.

[fidodido75]

It turns out that all we had to do was enabling the android device verification for our project.
link

[longb1997]

android device verification now DEPRECATED, but i still got this, what i should do now? :(((

[mikehardy]

You'll love the support for the new Play Integrity token provider for App Check released recently, I recommend moving to it.

[bphd]

E/Finsky (): [173] uks.a(849): Encountered exception whilst fetching from GMS, deferring to Finsky: com.google.android.gms.common.api.ApiException: 17: API: IntegrityApiDisplayListener.API is not available on this device. Connection failed with: ConnectionResult{statusCode=API_DISABLED, resolution=null, message=null}

[mikehardy]

I believe this indicates Play Services is not installed on the device. Perhaps it is a Huawei device or similar, without Google Play Services?

[bphd]

I believe this indicates Play Services is not installed on the device. Perhaps it is a Huawei device or similar, without Google Play Services?

There is MicroG and it gets BASIC_INTEGRITY

[mikehardy]

Ah - a little web searching indicates that API_DISABLED may be a project setting in your organization's google cloud console. That is, in the google cloud console you may need to go and alter your organization API restrictions etc to allow the API as this error may be because the API is disallowed for some reason for your organization's firebase app configuration

[bphd]

Ah - a little web searching indicates that API_DISABLED may be a project setting in your organization's google cloud console. That is, in the google cloud console you may need to go and alter your organization API restrictions etc to allow the API as this error may be because the API is disallowed for some reason for your organization's firebase app configuration

You say that whole Integrity API is disabled for the application? But I have been able to reproduce for PIAC and SPIC and TBC. So it seems to be a generalized overlook isn't it?

[bphd]

Idk if I still experiencing the error, haven't checked logs, but by deactivating persist.sys.pixelprops.gapps persist.sys.pixelprops.gms properties and resintalling vending/gsf/gms and spoofing build and provider (and btw using that module, or Osm0sis one when that one bother me) I achieve device integrity. I have difficulties achieving strong integrity but it's probably because my CROM throw UnsupportedOperationException() when DroidGuard ask for certificate chain, have to figure out how to patch from MagiSK, or LSP, or by replacing files