除了提供用於驗證的專屬 ID,Instance ID 還可產生安全性權杖,供其他服務使用。其他功能包括:
產生安全性權杖
Instance ID 提供簡單的 API,可產生安全性權杖,授權第三方存取應用程式的伺服器端管理資源。
驗證應用程式真實性
將執行個體 ID 權杖傳遞至伺服器,並使用執行個體 ID 服務驗證應用程式套件名稱,檢查是否含有有效的簽名。使用 Instance ID Cloud Service 驗證權杖有助於識別已知的應用程式。為降低成本和避免不必要的來回通訊,請將伺服器設為儲存這些符記,這樣只需檢查一次即可。在發生安全性疑慮時,應用程式可以刪除權杖或執行個體 ID,並產生新的權杖或執行個體 ID。此外,如果 Instance ID 伺服器偵測到錯誤或安全性問題,就會啟動權杖或 Instance ID 重新整理作業。
確認應用程式裝置處於啟用狀態
執行個體 ID 伺服器可告知您應用程式所安裝裝置的上次使用時間。您可以根據這項資訊決定是否保留應用程式資料,或是傳送推播訊息來重新與使用者互動。
找出並追蹤應用程式
執行個體 ID 在全球所有應用程式執行個體中皆不重複,因此資料庫可使用這項資訊來唯一識別及追蹤應用程式執行個體。伺服器端程式碼可透過執行個體 ID 雲端服務,驗證執行個體 ID 是否為正版,且與向伺服器註冊的原始應用程式相同。為了保護隱私權,您的應用程式可以刪除執行個體 ID,讓該 ID 不再與資料庫中的任何記錄建立關聯。下次應用程式呼叫 Instance ID 時,會取得全新的 Instance ID,且與先前的 ID 沒有任何關聯。
執行個體 ID 生命週期
應用程式上線時,Instance ID 服務會發出 InstanceID。InstanceID 由公開/私密金鑰組提供支援,私密金鑰會儲存在本機裝置上,公開金鑰則會註冊至執行個體 ID 服務。
[null,null,["上次更新時間:2025-08-31 (世界標準時間)。"],[[["\u003cp\u003e\u003cstrong\u003eWarning:\u003c/strong\u003e The Instance ID API is deprecated; for unique app installation identifiers, use the Firebase installations API instead.\u003c/p\u003e\n"],["\u003cp\u003eInstance ID offers key features like generating security tokens, verifying app authenticity, confirming app device activity, and identifying/tracking apps.\u003c/p\u003e\n"],["\u003cp\u003eInstance ID has a lifecycle involving issuing an ID, requesting fresh IDs and tokens, storing them on the server (optional), and handling token refreshes.\u003c/p\u003e\n"],["\u003cp\u003eClient implementation requires including the appropriate library and potentially a Project ID for token generation.\u003c/p\u003e\n"],["\u003cp\u003eFor detailed instructions, refer to the Android and iOS implementation guides.\u003c/p\u003e\n"]]],[],null,["# What is Instance ID?\n\n| **Warning:** The Instance ID API is deprecated. If you need to access unique app installation identifiers, use the [Firebase installations](//firebase.google.com/docs/projects/manage-installations) API. See also [Firebase installations and Instance ID](//firebase.google.com/docs/projects/manage-installations#fid-iid). The [server-side topic management API](https://developers.google.com/instance-id/reference/server#create_relationship_maps_for_app_instances) is still available.\n\nKey features\n------------\n\nIn addition to providing unique IDs for authentication, Instance ID\ncan generate security tokens for use with other services. Other features\ninclude:\n\n### Generate Security Tokens\n\n: Instance ID provides a simple API to generate security tokens that\n authorize third parties to access your app's server side managed resources.\n\n### Verify app authenticity\n\n: Pass Instance ID tokens to your server and use the Instance ID\n service to verify the app package name and check if it has a valid signature.\n Verifying tokens with the Instance ID Cloud Service helps identify known\n apps. To reduce cost and redundant round trip communications, configure your\n server to store these tokens so the check is needed only once.\n In the event of a security concern, your app can delete tokens, or\n Instance ID itself, and generate new ones. In addition, the\n Instance ID server initiates token or Instance ID refresh if it\n detects bugs or security issues.\n\n### Confirm app device is active\n\n: The Instance ID server can tell you when the device on which your app\n is installed was last used. Use this to decide whether to keep data from your\n app or send a push message to reengage with your users.\n\n### Identify and track apps\n\n: Instance ID is unique across all app instances across the world, so\n your database can use it to uniquely identify and track app instances. Your\n server-side code can verify, via the Instance ID cloud service, that an\n Instance ID is genuine and is the same ID as the original app that\n registered with your server. For privacy, your app can delete an Instance ID so\n it is no longer associated with any history in the database. The next time your\n app calls Instance ID it will get an entirely new Instance ID with no\n relationship to its previous one.\n\nInstance ID lifecycle\n---------------------\n\n1. The Instance ID service issues an `InstanceID` when your app comes online. The `InstanceID` is backed by a public/private key pair with the private key stored on the local device and the public key registered with the Instance ID service.\n2. Your app can request a fresh `InstanceID` whenever needed using the `getID()` method. Your app can store it on your server if you have one that supports your app.\n3. Your app can request tokens from the Instance ID service as needed using the `getToken()` method, and like `InstanceID`, your app can also store tokens on your own server. All tokens issued to your app belong to the app's `InstanceID`.\n4. Tokens are unique and secure, but your app or the Instance ID service may need to refresh tokens in the event of a security issue or when a user uninstalls and reinstalls your app during device restoration. Your app must implement a listener to respond to token refresh requests from the Instance ID service.\n\nClient implementation\n---------------------\n\nInstance ID runs on both Android and iOS. Each requires you to include\nthe appropriate library in your client app. Android requires\n[Google Play Services](https://developer.android.com/google/play-services/index.html). You will need a Project ID generated\nby the [](/console/help/new)[Google Developers Console](https://console.developers.google.com/project) if you intend\nto generate tokens.\n\nFor detailed instructions, see the [Android](/instance-id/guides/android-implementation)\nand [iOS](/instance-id/guides/ios-implementation) implementation guides."]]