com.google.android.play:integrity: Add the Library Without Skipping Backend Setup

Follow the setup chain

Use the official setup guide for the current dependency and project requirements. Pin the documented version appropriate to your integration rather than using an unbounded dynamic selector.

Check repository configuration and resolve the library through its supported distribution source. A dependency resolution failure is a build problem, not a failed device-integrity verdict.

Separate four identities

Do not substitute a Firebase web API key for a Cloud project number or place backend service-account credentials in the APK.

Prepare the selected request flow

The standard-request documentation describes the provider preparation lifecycle and request API. Perform preparation and error handling according to that lifecycle rather than constructing a new expensive setup operation for every UI frame or tap.

Keep protected action data consistent between client and server so the verdict can be evaluated in the intended context.

Diagnose errors at the correct layer

A Gradle sync error, provider initialization error, token acquisition error and server decoding error are different failures. Record the stage and a redacted error code.

Changing the library version randomly is unlikely to fix a wrong project number or certificate registration.

Validate before enforcement

Build and install the actual release-path artifact, acquire evidence and verify it server-side. APKLint's Gradle Dependency Checker can review the declaration and its package tools can inspect identity metadata, but neither establishes that the Cloud service or backend is correctly configured. Require a complete end-to-end verification test before making the result a condition for important user actions.