Firebase App Check
An app integrity verification service provided by Firebase that uses hardware attestation mechanisms to confirm requests originate from genuine apps, supporting attestation providers such as Play Integrity and reCAPTCHA Enterprise.
Timeline (last 90 days)
Firebase App Check is an application-layer protection mechanism independent of user identity authentication; it proves to the backend through device attestation (such as Android Play Integrity, iOS App Attest, and Web reCAPTCHA) that a request comes from a published app.
App Check and identity authentication solve different problems: authentication answers 'who are you,' while App Check answers 'did you come through my client'; the two usually need to be enabled at the same time.
When enabling App Check, it is recommended to first run in monitoring mode for a period to confirm that legitimate traffic is not mistakenly blocked, then switch to enforcement mode.
Firebase App Check uses the Google Play Integrity API by default on Android, generating a Google-signed integrity token on the device to verify the origin of requests.
App Check protects against unauthorized clients abusing the interface, not against quota abuse by malicious authenticated users; the latter requires joint control with Firebase Authentication and usage limits.
When using the Gemini Developer API, no separate API Key is required, because App Check is already responsible for verifying the origin of requests.
All Facts (7)
Firebase App Check在iOS上使用App Attest或DeviceCheck，在Android上使用Play Integrity API来验证请求来自合法应用实例
90%UnverifiedFirebase App Check is an application-layer protection mechanism independent of user identity authentication; it proves to the backend through device attestation (such as Android Play Integrity, iOS App Attest, and Web reCAPTCHA) that a request comes from a published app.
50%UnverifiedApp Check and identity authentication solve different problems: authentication answers 'who are you,' while App Check answers 'did you come through my client'; the two usually need to be enabled at the same time.
50%UnverifiedWhen enabling App Check, it is recommended to first run in monitoring mode for a period to confirm that legitimate traffic is not mistakenly blocked, then switch to enforcement mode.
50%UnverifiedWhen using the Gemini Developer API, no separate API Key is required, because App Check is already responsible for verifying the origin of requests.
50%UnverifiedFirebase App Check uses the Google Play Integrity API by default on Android, generating a Google-signed integrity token on the device to verify the origin of requests.
50%UnverifiedApp Check protects against unauthorized clients abusing the interface, not against quota abuse by malicious authenticated users; the latter requires joint control with Firebase Authentication and usage limits.
50%