firebase-app-check

Firebase App Check Skill

This skill defines how to correctly implement Firebase App Check in Flutter applications, covering provider selection, debug configuration, enforcement rollout, and security hardening.

When to Use

Use this skill when:

• Setting up and activating Firebase App Check in a Flutter project.
• Selecting the right attestation provider for each platform.
• Configuring debug providers for development, testing, and CI.
• Enabling enforcement and monitoring App Check metrics.
• Implementing token refresh handling and custom TTL configuration.

---

1. Setup and Configuration

flutter pub add firebase_app_check

import 'package:firebase_app_check/firebase_app_check.dart';

Initialize App Check after Firebase.initializeApp() and before using any Firebase services:

await Firebase.initializeApp();
await FirebaseAppCheck.instance.activate(
  webProvider: ReCaptchaV3Provider('recaptcha-v3-site-key'),
  androidProvider: AndroidProvider.playIntegrity,
  appleProvider: AppleProvider.deviceCheck,
);

Setup Checklist

1. Register apps in the Firebase console under Project Settings > App Check.
2. For web, obtain a reCAPTCHA v3 site key from the Firebase console.
3. Confirm activation completes before any Firestore, Storage, or RTDB calls.
4. Consider setting a custom TTL — shorter TTLs are more secure but consume quota faster.

Native FirebaseApp.configure() on Apple Platforms

Avoid calling FirebaseApp.configure() natively in your AppDelegate — Firebase.initializeApp() already configures the native default app. If you must call it, install your AppCheckProviderFactory before configure(); otherwise the Apple SDK locks in DeviceCheck on physical devices and the appleProvider passed to activate() (including AppleProvider.debug) is silently ignored. This is easiest to miss because simulators already default to the debug provider. activate() on Android is unaffected. See flutterfire#18613.