Search code examples
androidauthenticationgoogle-playleaderboard

Do Google Play leaderboards authenticate data being sent?


I want to integrate a leaderboard into my Android game. However I am undecided about using my own server or using Google's leaderboards. The one thing that will tilt my preference is whether or not the Google system authenticates scores being sent. I don't want someone to get the leaderboard ID (or some other data) and send fake scores to the board. If I make my own system (e.g. in PHP) I can at least set up a method to authenticate scores being sent to the server. E.g. by using a hashing system.

So is there any information about how Google authenticates data being send by apps?


Solution

  • There is no server-side score validation.

    Your game can attach some extra metadata with each submission, but you (or a script) need to poll the leaderboard and manually remove bogus entries. See Google Play Game Services Management Tools.

    (I've used the extra metadata in a word game attaching an anti-tamper hash as well other information about what the user actually did. I haven't caught any bogus hash-mismatched submissions, but it is a handy way to see what the top-scoring players are actually doing.)