Firebase App Check

Firebase App Check verifies that requests to your Firebase services come from your legitimate app, not from malicious scripts, bots, or unauthorized clients. Without App Check, anyone who finds your Firebase configuration object can read and write to your database or call your Cloud Functions directly, bypassing your app entirely.

The Problem App Check Solves

Your Firebase configuration object is included in your JavaScript bundle — it is visible to anyone who opens the browser developer tools. A bad actor can copy these credentials and write their own code that queries your Firestore, calls your Cloud Functions, or reads your Storage files directly, bypassing your app's UI and security rules.

Without App Check:
Malicious script ---> Uses your Firebase config ---> Reads/writes Firestore
                                                  ---> Calls Cloud Functions
                                                  ---> Drains your quota

With App Check:
Malicious script ---> Sends request without valid App Check token
                 ---> Firebase rejects the request
                 ---> Your services are protected

How App Check Works

App Check uses an attestation provider — a service that verifies your app is genuine. The most common attestation provider for web apps is reCAPTCHA Enterprise or reCAPTCHA v3. For Android apps, App Check uses Google Play Integrity. For iOS, it uses DeviceCheck or App Attest.

1. Your app requests a token from the attestation provider (reCAPTCHA)
2. The provider runs checks and issues a signed token
3. Your app includes this token in every Firebase request
4. Firebase validates the token with the provider
5. Valid token: request proceeds
6. Invalid or missing token: request rejected

Setting Up App Check for Web

Step 1 — Enable reCAPTCHA v3

Go to google.com/recaptcha/admin and register your site. Choose reCAPTCHA v3. Enter your domain name. Google gives you a site key (public) and a secret key (private).

Step 2 — Register Your App in Firebase Console

Go to Project Settings > App Check. Click Register next to your web app. Select reCAPTCHA v3 as the provider and enter the reCAPTCHA site key. Click Save.

Step 3 — Initialize App Check in Code

import { initializeApp } from "firebase/app";
import { initializeAppCheck, ReCaptchaV3Provider } from "firebase/app-check";

const app = initializeApp(firebaseConfig);

const appCheck = initializeAppCheck(app, {
  provider: new ReCaptchaV3Provider("your-recaptcha-v3-site-key"),
  isTokenAutoRefreshEnabled: true // refresh token before expiry
});

Place this initialization before any other Firebase service calls. The App Check token is automatically attached to every Firestore, Storage, and Cloud Function request from this point forward.

Enforcing App Check

Initializing App Check in your app code does not automatically block unauthorized requests. You must enforce it in each Firebase service:

Go to Project Settings > App Check. Under each service (Firestore, Storage, Functions), click Enforce. After enforcement, requests without a valid App Check token are rejected.

Enable enforcement in stages — first in debug mode, then monitor for token validation errors in the console before enforcing in production.

Debug Tokens for Development

reCAPTCHA requires a real browser interaction to generate tokens. During development in Node.js environments or automated tests, use a debug token instead:

// Before initializeApp — development only
if (process.env.NODE_ENV === "development") {
  self.FIREBASE_APPCHECK_DEBUG_TOKEN = true;
}

Firebase generates a debug token and logs it to the console. Register this token in the Firebase Console under App Check > Apps > Debug tokens. Development builds then use the debug token, while production builds use real reCAPTCHA tokens.

App Check with Cloud Functions

Verify App Check tokens in your Cloud Functions using the callable functions API:

const { onCall } = require("firebase-functions/v2/https");

exports.secureFunction = onCall(
  { enforceAppCheck: true },  // Automatically rejects requests without valid token
  async (request) => {
    // request.app is populated when App Check is valid
    console.log("App verified:", request.app.appId);
    return { message: "Request verified!" };
  }
);

Key Takeaway

App Check prevents unauthorized access to your Firebase services by requiring a valid attestation token with every request. Use reCAPTCHA v3 for web apps, initialize App Check before any other Firebase service, and enable enforcement in the console after testing with debug tokens in development. Enforce App Check on Firestore, Storage, and Cloud Functions separately. App Check works alongside security rules — it verifies the request comes from your app, while rules control what that request can access.