(upbeat music)
Hi, I’m Dom, product manager on the Google Play Developer team.
And Hi, I’m Solene.
I’m a Product Manager on the Device Itegrity team at Google.
Today, Solene and I are here to talk about the new Play Integrity API.
It helps you protect your game from abuse
and ensure that your game is experienced by your users the way you intend.
Android is an amazing platform for games.
Users can play in so many ways,
and there are so different games experiences to enjoy.
The majority of players are well intentioned
and enjoy playing games the way they are intended.
However, there are always players with less well intentions.
This means you have to deal with abuse.
This could be cheating, tampering, risky traffic, unauthorized access,
and other types of abuse that comes from unknown devices and untrustworthy accounts.
In the past, we introduced different projects to help with specific problems,
such as SafetyNet Attestation API, and Google Play Licensing.
This helps thousands of apps to trust devices and apps every day.
But today the challenge continues to evolve.
We keep hearing about more sophisticated forms of abuse
that puts your revenue and your players at risk.
We also hear about the complexity you face in integrating with multiple APIs,
and the fear of letting serious abuse go through without even knowing.
That’s why, today, we believe that protecting your games
start with the most advanced integrity technologies unified in one single API.
So here’s what we’re doing to help.
The Play Integrity API helps you protect your game from different types of abuse
by letting your game server determine whether or not it can trust
an interaction with your installed game.
The integrity API helps you answer three questions:
Is this your genuine game binary?
Is this a genuine Play user account?
And is this a genuine Android device?
If there’s an issue, then you can decide whether or not
your game should increase friction to reduce the risk from that traffic.
Now, there are a few benefits of the API. It’s fully supported by Google Play.
You’ll be able to configure the API response from your Play Console.
We’ll be making available documentation, samples, and best practices
and you can contact developer support with questions.
The integrity response is small and encrypted
allowing us to add multiple integrity signals in one token,
without the need for you to implement multiple APIs.
The API is also forward-looking.
It can scale to new device types and form factors.
And in the future, when we add new integrity signals,
you'll be able to take advantage of them straight away.
So how does it work?
What you’re trying to determine is whether your game server
can trust a game you're communicating with and the device it's running on.
So the API allows your game server to communicate with Play server
to get verdict in a way that cannot be interfered with.
Let’s look at the main steps together.
First, the user tries to do something, like sign in or join a live game.
At this moment, your back end starts an integrity check with a unique ID.
Your game makes a call to Play Integrity API.
The Play server has a lot of different signals to assess whether the device
has been compromised and whether it has passed certification test.
Play also verifies the license.
As a result, the Play Integrity API sends back a signed and encrypted verdict
about whether you can trust the device and the binary.
Your game forwards it back to your server where you can analyze the verdict
and check that it comes back with the same ID you sent it with.
If everything is fine, you can let your player move on.
And all this happens almost instantaneously,
so your players won’t notice a delay.
This is how the Play Integrity API works.
If you use the SafetyNet Attestation API, the implementation is very similar.
We’re going to publish a migration guide to help you get started.
Now there are some important things to remember when using the API.
Identify your main concern.
Do you have a cheating problem, beta leakage, piracy or something else?
Make sure you're measuring the problem and how much it's costing you.
And then you can determine how much effort you wanna invest in fixing it.
There's no silver bullet when it comes to fighting abuse,
and the Integrity API is not intended to be one.
Make sure you’re using it as part of an overall security and anti-abuse strategy.
Take into account the cost you might be adding for good users and false positives.
Rather than blocking traffic outright,
it’s generally better to increase friction or reduce functionality to risky traffic.
Finally keep measuring and evolving.
Make sure your listening to your users, keep up to date with industry best practices,
and look out for new features from Android and Google Play
which can help your anti-abuse strategy.
Today we’re launching the Play Integrity API early access program to some close partners.
Express interest in joining the EAP at g.co/play/integrityapi.
Later in the year, we’ll make the API more widely available,
and we’ll provide some guidance on migrating from SafetyNet Attestation & Play Licensing.
Thanks for watching. And thanks, Solene.
Thank you, Dom, and thank you all for joining.
We are very excited to launch this API and hear about your feedback.
(upbeat music)