I am curious about if i use Google Play Integrity API to get an integrity token to authenticate my api request to my own backend, so after my app get an integrity token, is it possible an integrity token issued by Google Play Integrity API to get stolen somehow from app’s memory etc (seems no serious concern in-transit) ? So would it be better if i implement Firebase App Check on server side to authenticate if the api request with valid integrity token comes from a valid device & app like a genuine instance of my app, i mean if there is an actual risk for a valid integrity token to get stolen and be used from another app ?

Or am i missing something ? Thank you all…

I read some documentation and found some info but i want to ensure about this topic because its security related.