Google LLC

Google LLC

appInstanceIdToken property

The appInstanceIdToken property and X-Goog-Firebase-Installations-Auth header contain a JWT token that is used to identify and authenticate the user.

The token at least contains the Firebase Installation ID (FID), which uniquely identifies an installation of an app on a device.

Example #

Token:

eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJhcHBJZCI6IjE6MTA2NTQ3MzU5ODYyNDphbmRyb2lkOmQ3ODIwNzU2YzVjODA4ZGIwM2Q1YzUiLCJleHAiOjE3MTUwMDY3MDAsImZpZCI6ImVkeElubzhmVGY2WDR5X0s1WjYxNVAiLCJwcm9qZWN0TnVtYmVyIjoxMDY1NDczNTk4NjI0fQ.AB2LPV8wRAIgKWmNcG6EyL96sJbjdrK4fqE2IYusPUVw-cvxvQPfAOQCIBUOMpAbN88ZsfNHvUurgwOv7w8u1zT-7t4_mx_Wp8kN

Decoded:

1{
2    "appId": "1:1065473598624:android:d7820756c5c808db03d5c5",
3    "exp": 1715006700,
4    "fid": "edxIno8fTf6X4y_K5Z615P",
5    "projectNumber": 1065473598624
6}

device_info.os_type property

The device_info.os_type holds the device’s operating system.

In our request database, we have observed the following values being transmitted for this property:

  • ANDROID
  • 2

For requests made from Android devices, the value was always ANDROID. For requests made from iOS devices, it was always 2.

IDE property

According to the cookie section of Google’s privacy policy (archived), the IDE cookie is “used to show Google ads on non-Google sites” and “to personalize the ads [users] see”. It lasts for 13 months.

According to the cookie information for Google’s ad products (archived), it is stored on the doubleclick.net domain and used by the following products: Campaign Manager, Display & Video 360, Google Ad Manager, Google Analytics, Search Ads 360

idToken property

The idToken property contains a JWT token that is used to identify and authenticate the user. The token at least contains a unique user ID. It can also be linked with and include additional information like an email address.

Example without additional information #

Token:

eyJhbGciOiJSUzI1NiIsImtpZCI6ImIyZGZmNzhhMGJkZDVhMDIyMTIwNjM0OTlkNzdlZjRkZWVkMWY2NWIiLCJ0eXAiOiJKV1QifQ.eyJwcm92aWRlcl9pZCI6ImFub255bW91cyIsImlzcyI6Imh0dHBzOi8vc2VjdXJldG9rZW4uZ29vZ2xlLmNvbS9zcGVlY2hpZnltb2JpbGUiLCJhdWQiOiJzcGVlY2hpZnltb2JpbGUiLCJhdXRoX3RpbWUiOjE2OTA0MTQzOTgsInVzZXJfaWQiOiJqUkJSNTBzZEpEVHo3SURSbjk0dXBQQUh3akkyIiwic3ViIjoialJCUjUwc2RKRFR6N0lEUm45NHVwUEFId2pJMiIsImlhdCI6MTY5MDQxNDM5OCwiZXhwIjoxNjkwNDE3OTk4LCJmaXJlYmFzZSI6eyJpZGVudGl0aWVzIjp7fSwic2lnbl9pbl9wcm92aWRlciI6ImFub255bW91cyJ9fQ.OJq6IblUtrXcdaA9PYCDzCFoT527U8umn-UGdMBJOA33wT_GhlEeK-i0uc0LHj--OcrSiSrAZ2cc3uharZ3ZAm2ZXP89o-_zaCn1HY7dnnK2unNvyBSjqzast5NKNZD9wt_UbWNA8QEPeOsMMoQfipE_j-qJsHwgF3C6ehcm0Yr_1cMyu5wpJjvq-siIIQXAlPovE7G4emwJS2IMsty-8KjsKXeTRJ_Al_w8-mBI2XIN_xuDt_v5FG8XfioalP6AkCw34QNhUXOuu8EtzYQFiMuRNYxVqRB2BSOvAEvuXfnS-fFENN14sMIR9aBsoWZeu86QtHyPn46B2zXeah9kEw

Decoded:

 1{
 2    "provider_id": "anonymous",
 3    "iss": "https://securetoken.google.com/speechifymobile",
 4    "aud": "speechifymobile",
 5    "auth_time": 1690414398,
 6    "user_id": "jRBR50sdJDTz7IDRn94upPAHwjI2",
 7    "sub": "jRBR50sdJDTz7IDRn94upPAHwjI2",
 8    "iat": 1690414398,
 9    "exp": 1690417998,
10    "firebase": {
11        "identities": {},
12        "sign_in_provider": "anonymous"
13    }
14}

Example with email address #

Token:

eyJhbGciOiJSUzI1NiIsImtpZCI6IjQ2NDExN2FjMzk2YmM3MWM4YzU5ZmI1MTlmMDEzZTJiNWJiNmM2ZTEiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL3NlY3VyZXRva2VuLmdvb2dsZS5jb20vaHVnLXByb2R1Y3Rpb24tOWRkZTMiLCJhdWQiOiJodWctcHJvZHVjdGlvbi05ZGRlMyIsImF1dGhfdGltZSI6MTY0ODY3ODMzMSwidXNlcl9pZCI6InlGWHJMckE2SXJYak1BRWhlRmFqbGw5dEJxSDIiLCJzdWIiOiJ5RlhyTHJBNklyWGpNQUVoZUZhamxsOXRCcUgyIiwiaWF0IjoxNjQ4Njc4MzMxLCJleHAiOjE2NDg2ODE5MzEsImVtYWlsIjoiM2ZiZDI5OTctNjJkNS00MTEzLTk1MjEtZGZiOTM3MjlkMzM5X2EzY2Y0N2E5YmIxODRjOGRAYXBwdGl2YXRlLml0IiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJmaXJlYmFzZSI6eyJpZGVudGl0aWVzIjp7ImVtYWlsIjpbIjNmYmQyOTk3LTYyZDUtNDExMy05NTIxLWRmYjkzNzI5ZDMzOV9hM2NmNDdhOWJiMTg0YzhkQGFwcHRpdmF0ZS5pdCJdfSwic2lnbl9pbl9wcm92aWRlciI6InBhc3N3b3JkIn19.cjp4uyKf_aAhw4FdUt4u6dSs1O5mwyiitNUeIbdHFLYZ4L85hJJjxus4nvbLeHBz5nKAtkng0EITj6XwaUtrXmEWLtbpTVPJNo5C8YP-SUzxWeEKSlhWeF_pJo7saBpBCXxnukf7EQG7F7TW0qqEkqJyrM4y0ApLEO9z8l-3Rpuc1fO24VxML5xjxtYwkhftUDVdvnNaHwCexKw0HmS9cSYT_ey1sCxbLFldYgh0XYJ_R-UoGopSiAfaXtzbJpVwT5eYkXI_IEZyNB2UEVoO-f8Pg2WdnNPwFCGXLZeIPv5o_epaYAtUeLh7vN0aFN1jxVGyirJ9t8hY_5GaQky6Pw

Decoded:

 1{
 2    "iss": "https://securetoken.google.com/hug-production-9dde3",
 3    "aud": "hug-production-9dde3",
 4    "auth_time": 1648678331,
 5    "user_id": "yFXrLrA6IrXjMAEheFajll9tBqH2",
 6    "sub": "yFXrLrA6IrXjMAEheFajll9tBqH2",
 7    "iat": 1648678331,
 8    "exp": 1648681931,
 9    "email": "3fbd2997-62d5-4113-9521-dfb93729d339_a3cf47a9bb184c8d@apptivate.it",
10    "email_verified": false,
11    "firebase": {
12        "identities": {
13            "email": [
14                "3fbd2997-62d5-4113-9521-dfb93729d339_a3cf47a9bb184c8d@apptivate.it"
15            ]
16        },
17        "sign_in_provider": "password"
18    }
19}

rdid property

According to the targeting parameter documentation in Google’s Ad Manager Help (archived), the rdid property holds a “resettable device identifier”.

Google’s further documentation on resettable device identifiers (archived) lists the following examples of RDIDs: Google AdID, Apple IDFA, Amazon AFAI, Roku RIDA, Xbox MSAI

vnm property

The vnm property in the query string always matches the app’s version for the requests in our database.

On iOS, it holds the human-readable version. A few samples:

  • vnm=2.17.0 comes from com.elecont.EWClock@2.17
  • vnm=22.7.2 comes from com.picsart.studio@22.7.2
  • vnm=5.85.2 comes from com.cyberlink.youperfect@5.85.2
  • vnm=1.4.8 comes from com.crazymaplestudio.aurora@1.4.08
  • vnm=1.0.2 comes from com.smmservice.videoforairplay@1.0.2

On Android, it holds the version code. A few samples:

  • vnm=140 comes from com.translate.talkingtranslator@2.3.9:

    1$ aapt dump badging com.translate.talkingtranslator.apk
2package: name='com.translate.talkingtranslator' versionCode='140' versionName='2.3.9' compileSdkVersion='31' compileSdkVersionCodename='12'

  • vnm=43 comes from com.bravo.booster@1.3.0.1001:

    1$ aapt dump badging com.bravo.booster.apk
2package: name='com.bravo.booster' versionCode='43' versionName='1.3.0.1001' compileSdkVersion='31' compileSdkVersionCodename='12'

  • vnm=40 comes from com.paradyme.citysmash@1.40:

    1$ aapt dump badging com.paradyme.citysmash.apk
2package: name='com.paradyme.citysmash' versionCode='40' versionName='1.40' compileSdkVersion='30' compileSdkVersionCodename='11'

  • vnm=2736704 comes from com.outdooractive.Outdooractive@3.9.0:

    1$ aapt dump badging com.outdooractive.Outdooractive.apk
2package: name='com.outdooractive.Outdooractive' versionCode='2736704' versionName='3.9.0' compileSdkVersion='31' compileSdkVersionCodename='12'

  • vnm=2070010 comes from com.easybrain.block.puzzle.games@2.7.0:

    1$ aapt dump badging com.easybrain.block.puzzle.games/com.easybrain.block.puzzle.games.apk
2package: name='com.easybrain.block.puzzle.games' versionCode='2070010' versionName='2.7.0' compileSdkVersion='31' compileSdkVersionCodename='12'

It’s also likely that “vnm” is an acronym for “version number”.