Remove the com.google.android.gms:play-services-safetynet dependency from build.gradle; SafetyNet Attestation was fully shut down on January 31, 2025
Add com.google.android.play:integrity to build.gradle and call IntegrityManagerFactory.create() in place of SafetyNetClient
Replace the SafetyNet nonce string with a requestHash field computed as a digest of the request content; update the backend token verification call accordingly
On the backend, replace the SafetyNet verify endpoint call with the Play Integrity API decryptIntegrityToken call using a service account with the playintegrity.readonly scope
Map SafetyNet's ctsProfileMatch and basicIntegrity to the Play Integrity equivalents: MEETS_DEVICE_INTEGRITY covers ctsProfileMatch; MEETS_BASIC_INTEGRITY covers basicIntegrity
Test on a variety of devices including non-certified devices to ensure verdict handling logic does not regress on edge-case verdicts
Known gotchas
SafetyNet Attestation API stopped returning responses after January 31, 2025; any app still calling it will receive errors, making migration urgent for all active apps
SafetyNet's JWS response was self-contained and could be verified locally with Google's public key; Play Integrity tokens must be sent to Google's backend for decryption — local decryption is not supported
The Play Integrity API requires Google Play Services to be installed; the API is not available on devices without GMS (e.g., Huawei HMS-only devices), so a separate attestation path is required for those
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp