App Check
A security layer provided by Firebase that verifies application identity through device-side attestation mechanisms—DeviceCheck or App Attest on iOS, and Play Integrity API on Android. It confirms that requests originate from legitimate applications, thereby preventing unauthorized access and quota abuse.
Core Facts
Timeline (last 90 days)
App Check verifies the device and app signature via Play Integrity, DeviceCheck or App Attest, confirming that requests genuinely come from an authorized, authentic app, thereby blocking script-forged calls.
The author early on packaged the AI key inside the app APK, but later, because APK contents can be extracted, switched to Firebase AI Logic, so that the app contains no key, combined with App Check to ensure requests come from the real app.
Firebase AI Logic packages Google Cloud's Gemini model capabilities into an SDK suitable for direct client-side invocation, with built-in API Key management, security rules integration, and linkage with the Firebase ecosystem such as Firestore and App Check.
Developers can directly call Gemini in iOS, Android, and Web applications without building a backend proxy, and prevent API abuse through App Check.
Without App Check, someone in possession of the app's configuration information could forge requests to bypass quota limits or abuse AI calls, resulting in unexpected charges and security risks.
Firebase AI Logic pushes key management and access control down to the platform layer through App Check and Firebase authentication mechanisms, enabling the client SDK to communicate directly with generative models without exposing keys.
Firebase AI Logic enforces App Check on every call.
App Check integrates the Google Play Integrity API on Android and uses Apple DeviceCheck or App Attest on iOS.
App Check is now enabled by default in all new Firebase projects, requiring every client request to prove it originates from a legitimate application binary before touching Gemini quotas.
App Check has added reCAPTCHA Enterprise as an attestation option, currently available in preview on Apple platforms, Android, and Flutter.
All Facts (10)
Firebase AI Logic packages Google Cloud's Gemini model capabilities into an SDK suitable for direct client-side invocation, with built-in API Key management, security rules integration, and linkage with the Firebase ecosystem such as Firestore and App Check.
65%UnverifiedApp Check verifies the device and app signature via Play Integrity, DeviceCheck or App Attest, confirming that requests genuinely come from an authorized, authentic app, thereby blocking script-forged calls.
50%UnverifiedDevelopers can directly call Gemini in iOS, Android, and Web applications without building a backend proxy, and prevent API abuse through App Check.
50%UnverifiedApp Check integrates the Google Play Integrity API on Android and uses Apple DeviceCheck or App Attest on iOS.
50%UnverifiedWithout App Check, someone in possession of the app's configuration information could forge requests to bypass quota limits or abuse AI calls, resulting in unexpected charges and security risks.
50%UnverifiedFirebase AI Logic pushes key management and access control down to the platform layer through App Check and Firebase authentication mechanisms, enabling the client SDK to communicate directly with generative models without exposing keys.
50%UnverifiedFirebase AI Logic enforces App Check on every call.
50%UnverifiedThe author early on packaged the AI key inside the app APK, but later, because APK contents can be extracted, switched to Firebase AI Logic, so that the app contains no key, combined with App Check to ensure requests come from the real app.
50%UnverifiedApp Check is now enabled by default in all new Firebase projects, requiring every client request to prove it originates from a legitimate application binary before touching Gemini quotas.
50%UnverifiedApp Check has added reCAPTCHA Enterprise as an attestation option, currently available in preview on Apple platforms, Android, and Flutter.
50%