What is Firebase App Check?
According to the documentation, Firebase App Check is a security service that helps protect your app backends from abuse by preventing unauthorized clients from accessing your backend resources. It attests to app authenticity and device integrity. Requests without a valid attestation token are rejected.
Core Features
- Attests to app authenticity and device integrity
- Caches tokens for use with protected services
- Works with both Google backends and custom backends
- Rejects requests lacking a valid attestation token
- Supports several attestation providers per platform: DeviceCheck, App Attest, Play Integrity and reCAPTCHA Enterprise
Typical Use Cases
Protecting databases and storage: Access to Cloud Firestore, Realtime Database and Cloud Storage is restricted to requests from the authentic app.
Securing AI calls: Calls made through Firebase AI Logic are protected against abuse by third-party clients.
Custom backends: Self-operated services can also validate App Check tokens and reject requests without one.
Benefits
- Verifies app authenticity without additional user interaction
- Available across iOS+, Android, Web, Flutter, Unity and C++
- Uses the platform-native attestation mechanisms
- Combines with Firebase Authentication and the security rules of Firebase services
Integration with innFactory
As a certified Google Cloud Partner, innFactory supports your rollout of Firebase App Check: choosing the right attestation providers, enabling it gradually in monitoring mode and protecting your own backend endpoints.
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is Firebase App Check?
According to the documentation, Firebase App Check helps protect your app backends from abuse by preventing unauthorized clients from accessing your backend resources. It verifies that API requests come from authentic apps running on untampered devices.
Which attestation providers are supported?
On Apple platforms DeviceCheck, App Attest and reCAPTCHA Enterprise; on Android Play Integrity and reCAPTCHA Enterprise; on the web reCAPTCHA Enterprise.
Which services can App Check protect?
According to the documentation, these include Firebase Authentication (Preview), SQL Connect, Cloud Firestore, Realtime Database, Cloud Storage, Cloud Functions (callable only), Firebase AI Logic, as well as Google Maps Platform services and Google Identity for iOS. Custom backends can also be protected.
Which platforms are supported?
According to the documentation, App Check supports iOS+, Android, Web, Flutter, Unity and C++.
What does Firebase App Check cost?
Costs depend on the chosen attestation provider. According to the documentation, reCAPTCHA Enterprise is free for 10,000 monthly assessments and charged beyond that. Play Integrity includes 10,000 daily calls on the Standard tier; DeviceCheck and App Attest are subject to Apple quotas.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Google Cloud (official documentation). This page does not represent an offer by Google Cloud.
