Verify the JWS Response

[emreyasar]

How can we verify the JWS response has signed by Google? I think that there is 2 ways to do it. Manually or using Google Device Verification API. In Android Developers page, there is a Note about this API :

"You need an API key to access the Android Device Verification API, and the API is rate-limited. For these reasons, you should use the API only for testing during the initial development stage. You shouldn't use this verification API in a production scenario."

How can I verify the JWS response signed by Google via using offline solution ?

[borbalabenko]

https://github.com/googlesamples/android-play-safetynet/blob/master/server/java/src/main/java/OfflineVerify.java