Validate phone authentication without showing the Recaptcha on Android in February 2023 (Firebase)

Question

I developed an app with Flutter and Firebase that uses the phone authentication feature for Android and IOS. Everything works as expected except that the recaptcha is showing for Android.

To solve this, it says in the documentation that we need to use SafetyNet, however, it is impossible now to enable it from Firebase AppChecker since it's deprecated. I have been using the new Play Integrity API that is supposed to replace SafetyNet but it doesn't seem to work at the moment (the recaptcha is visible).

If someone has a solution, please share it! Thank you in advance for your time 🙏

Answer 1

You're right: the SafetyNet API is deprecated and cannot be used for newly created projects after 31 January 2023.

Unfortunately, the Play Integrity API cannot handle OTP authentication at the moment. The Google Support wrote me:

[...] Please note that Firebase Phone Authentication (OTP) has not yet been featured for Play Integrity API yet.

The solution is to further use the SafetyNet Attestation API. You have to apply for this. The process took around three weeks for my project.

If you got approved, you have to go to the library page in your Google API Console and activate the "Android Device Verification API".

With the following project setup it should work and you shouldn't see the recaptcha anymore:

• Google Cloud Console: Link your app via App Integrity with the Google Play Integrity API
• firebase project --> App Check --> Select your Android app --> Link it with the Play Integrity API
• Enable Android Device Verification API after successfully applying for it

Note: the process is independent of using Flutter and is the same for e.g. also React Native or Android projects.