Firebase App Check: What It Is, Why & How To Use It (Examples)

A few months after launching an app, many developers open their Firebase bill and see something strange: thousands of reads, writes or AI calls that do not match the number of real users. Very often the reason is simple. Someone copied the app’s Firebase config, wrote a small script, and started calling the backend directly.

Firebase App Check is the tool Google built to stop exactly this. In this guide I will explain what App Check is, why it matters, when and where to use it, and how to set it up step by step, with real examples from industries like food delivery, fintech and AI apps.

Last reviewed: November 2026

In this guide:

What is App Check?
How App Check works
Why use App Check?
App Check vs Authentication vs Security Rules
Where to use App Check
When to use App Check
How to set up App Check step by step
Real-time industry examples
FAQs

What Is Firebase App Check?

Firebase App Check is a security service that makes sure requests to your backend come from your real app, running on a real device, and not from a script, a bot, an emulator farm or a modified copy of your app.

Here is an everyday comparison. Think of an office building:

Firebase Authentication is the employee ID card. It tells you who the person is.
App Check is the guard at the gate checking that people came through the official entrance, not over the back wall. It tells you how the request reached you.

Your Firebase config (API key, project ID) is not secret. Anyone can pull it out of your APK or website in a few minutes. App Check closes this gap, because a script cannot easily produce the proof that only your genuine app can get.

How App Check Works

Your app asks an attestation provider to confirm it is genuine. On Android this is Google Play Integrity.
The provider checks the app and the device, and returns a signed result.
The App Check server verifies that result and gives your app a short-lived App Check token.
The Firebase SDK caches the token and attaches it to every request to Firestore, Storage, Functions and other protected services.
When enforcement is on, any request without a valid token is rejected.

The good news: steps 1 to 4 happen automatically once you add a few lines of code. You never handle the token yourself when calling Firebase services.

Attestation Providers by Platform

Platform	Provider	What it checks
Android	Play Integrity (default) or reCAPTCHA Enterprise	Genuine app binary from Google Play, genuine Android device
iOS / Apple	App Attest, DeviceCheck or reCAPTCHA Enterprise	Genuine app and Apple device
Web	reCAPTCHA Enterprise	Real browser and human-like traffic, not bots
Local testing / CI	Debug provider	A secret debug token you register in the console

Services App Check Can Protect

Cloud Firestore (see our Firestore guide)
Firebase Realtime Database
Cloud Storage for Firebase
Cloud Functions for Firebase (callable functions)
Firebase AI Logic (Gemini calls from your app)
Firebase Authentication (preview) and Data Connect
Some Google Maps Platform APIs, such as Maps JavaScript API and Places API (New)
Your own backend, for example an API on Cloud Run

Why Use App Check?

Stop billing fraud: Bots reading Firestore in a loop or calling paid AI APIs can create a huge bill. This is often called a “denial of wallet” attack.
Stop data scraping: Competitors or spammers cannot easily copy your public listings, profiles or prices with a script.
Stop fake sign-ups and spam: Mass account creation and fake reviews need automation, and App Check makes automation much harder.
Stop modified apps: Cracked APKs that unlock paid features or skip ads fail the integrity check.
Protect your quotas: Your free tier and API limits stay available for real users.
Low effort: For Android, setup is usually under an hour, and there is no extra backend code for Firebase services.

App Check vs Authentication vs Security Rules

This is the most common confusion, so let me make it clear. These are three different locks, and a safe app uses all three.

Layer	Question it answers	Protects
App Check	Is this request coming from my genuine app?	You, the developer (bills, data, quotas)
Firebase Authentication	Who is this user?	Your users’ accounts
Security Rules / IAM	Is this user allowed to do this action?	Each piece of data

Important: App Check does not replace security rules. A real user using your real app can still try to read someone else’s data, and only rules stop that. Also, App Check reduces abuse a lot, but no tool can block 100% of attackers, especially on rooted devices.

Where to Use App Check

Where	Why it helps
Mobile apps that use Firestore or Realtime Database directly	Only your app can read and write, not scripts using your config
Apps that store images or videos in Cloud Storage	Stops hotlinking and mass downloading of your media
Apps calling Gemini or other AI from the client	Stops strangers from using your AI quota and budget
Callable Cloud Functions (OTP, coupons, payments)	Blocks bots from triggering costly or sensitive actions
Your own REST API on Cloud Run or any server	Your API accepts only requests from your apps
Websites with sign-up, contact or booking forms	reCAPTCHA Enterprise filters bots in the background

When to Use App Check

Add App Check when:

Your app is about to go live on the Play Store or App Store. The best time is before launch, not after an attack.
Your project is on the pay-as-you-go Blaze plan, where abuse turns directly into money.
You see usage spikes that do not match your active users.
Your app offers something worth stealing: rewards, coupons, cashback, premium content or AI features.
Your data is valuable to scrapers, such as property listings, job posts, profiles or prices.

You may not need it yet when:

The app is only a personal learning project with no billing enabled.
The app is distributed outside Google Play only. The built-in Play Integrity provider supports Play-distributed apps, so you would need reCAPTCHA Enterprise or a custom provider.
Your backend is called only by other servers. Use service accounts and IAM for server-to-server security instead.

How to Set Up App Check Step by Step (Android)

I will use Android with Play Integrity, because it is the most common case in India. You need an app that already uses Firebase and is uploaded to Google Play (an internal or closed testing track is enough).

Step 1: Link Play Integrity to Your Firebase Project

Open Google Play Console and select your app.
Go to Release → App integrity.
In the Play Integrity API section, click Link Cloud project and choose your Firebase project.
On the same page, open App signing and copy the SHA-256 fingerprint of the app signing key. You need it in the next step.

Tip: Use the app signing key SHA-256 from Play Console, not your upload key. This is the most common reason App Check fails on production builds.

Step 2: Register Your App in the Firebase Console

Open the Firebase console and go to Security → App Check.
Open the Apps tab and click your Android app.
Choose Play Integrity, paste the SHA-256 fingerprint and click Save.
Leave the token time-to-live at the default unless you have a reason to change it. It can be set between 30 minutes and 7 days.

Step 3: Add the App Check Libraries

In app/build.gradle.kts, add the libraries. Replace LATEST_VERSION with the current Firebase BoM version from the Firebase release notes:

android {
    buildFeatures {
        buildConfig = true
    }
}

dependencies {
    implementation(platform("com.google.firebase:firebase-bom:LATEST_VERSION"))
    implementation("com.google.firebase:firebase-appcheck-playintegrity")
    implementation("com.google.firebase:firebase-appcheck-debug")
}

Step 4: Turn On App Check When the App Starts

Create (or open) your Application class. Debug builds use the debug provider so you can test on an emulator. Release builds use Play Integrity.

package com.example.myapp

import android.app.Application
import com.google.firebase.Firebase
import com.google.firebase.appcheck.appCheck
import com.google.firebase.appcheck.debug.DebugAppCheckProviderFactory
import com.google.firebase.appcheck.playintegrity.PlayIntegrityAppCheckProviderFactory
import com.google.firebase.initialize

class MyApp : Application() {
    override fun onCreate() {
        super.onCreate()
        Firebase.initialize(context = this)

        val providerFactory = if (BuildConfig.DEBUG) {
            DebugAppCheckProviderFactory.getInstance()
        } else {
            PlayIntegrityAppCheckProviderFactory.getInstance()
        }
        Firebase.appCheck.installAppCheckProviderFactory(providerFactory)
    }
}

<application
    android:name=".MyApp"
    ... >

Step 5: Register Your Debug Token

Run the debug build on your emulator or phone.
Open Logcat and search for DebugAppCheckProvider. You will see a line asking you to add a debug secret to the allow list, followed by a long token.
In Firebase console → App Check → Apps, open the menu (⋮) next to your app, click Manage debug tokens, and add that token.

Treat this token like a password. Anyone who has it can pass App Check, so never commit it to GitHub and delete it when a team member leaves.

Step 6: Monitor Before You Enforce

Release the update to Play Store and wait. In App Check → APIs, Firebase shows each service’s requests split into verified, outdated client, unknown origin and invalid.

Do not enforce on day one. Users on older app versions do not send tokens yet. Wait until most traffic is verified (often a week or two, depending on how fast users update). If you see clear abuse, you can enforce sooner.

Step 7: Turn On Enforcement

In App Check → APIs, click a service such as Cloud Firestore and choose Enforce. Repeat for Storage, Realtime Database and others. From now on, requests without a valid token are rejected. Enforcement can take up to about 15 minutes to apply.

Protect Callable Cloud Functions

For callable functions, enforcement is set in code. Here is a coupon function that only your genuine app can call:

const { onCall, HttpsError } = require("firebase-functions/v2/https");

exports.redeemCoupon = onCall({ enforceAppCheck: true }, (request) => {
  if (!request.auth) {
    throw new HttpsError("unauthenticated", "Please sign in first.");
  }
  const code = request.data.code;
  // ... check the coupon and apply the discount
  return { success: true, message: `Coupon ${code} applied` };
});

Protect Your Own Backend (Cloud Run Example)

If your app calls your own API, the app must send the token itself, and the server must verify it.

Android side: get the token and send it in the X-Firebase-AppCheck header.

Firebase.appCheck.getAppCheckToken(false)
    .addOnSuccessListener { result ->
        val request = Request.Builder()
            .url("https://YOUR_SERVICE_URL/orders/A1001")
            .addHeader("X-Firebase-AppCheck", result.token)
            .build()
        // send with OkHttp or Retrofit as usual
    }

Server side (Python, Flask): verify the token before doing any work. Install the libraries with pip install flask firebase-admin.

import os

import firebase_admin
from firebase_admin import app_check
from flask import Flask, abort, jsonify, request

firebase_admin.initialize_app()
app = Flask(__name__)


@app.before_request
def verify_app_check():
    token = request.headers.get("X-Firebase-AppCheck")
    if not token:
        abort(401)
    try:
        app_check.verify_token(token)
    except Exception:
        abort(401)


@app.get("/orders/<order_id>")
def get_order(order_id):
    return jsonify(orderId=order_id, status="Packed")


if __name__ == "__main__":
    app.run(host="0.0.0.0", port=int(os.environ.get("PORT", 8080)))

On Cloud Run, initialize_app() uses the attached service account automatically, so make sure it belongs to the same Firebase project.

Quick Setup for Websites

For a web app, create a reCAPTCHA Enterprise key, register the web app in App Check, and add this after initializing Firebase:

import { initializeApp } from "firebase/app";
import { initializeAppCheck, ReCaptchaEnterpriseProvider } from "firebase/app-check";

const app = initializeApp(firebaseConfig);

initializeAppCheck(app, {
  provider: new ReCaptchaEnterpriseProvider("YOUR_RECAPTCHA_ENTERPRISE_SITE_KEY"),
  isTokenAutoRefreshEnabled: true,
});

Real-Time Industry Examples

The examples below are typical situations that companies in these industries face. Each one shows the problem, what goes wrong without App Check, and how App Check fixes it.

1. Food Delivery: Coupon and Referral Abuse

Problem: A food delivery app gives ₹100 off on the first order. Fraudsters write a script that creates thousands of accounts and calls the “apply coupon” function directly, then resell the discounted orders.

With App Check: The redeemCoupon callable function uses enforceAppCheck: true. The script has no valid token, so every call fails. Real customers in the real app notice nothing.

2. Fintech and UPI Apps: Cashback Fraud from Modified APKs

Problem: A payments app offers scratch-card cashback. Attackers modify the APK to repeat the reward request and run it on emulators.

With App Check: Play Integrity reports that the app binary is not the one from Google Play, or that the device is not genuine. No token is issued, and the reward API on Cloud Run rejects the request. Fintech teams usually combine this with server-side limits and their own fraud checks.

3. AI Apps: Protecting Gemini Quota and Budget

Problem: An AI photo or chat app calls Gemini through Firebase AI Logic. Someone extracts the Firebase config and uses your project as a free AI API, running up a large bill overnight.

With App Check: Enforcement on Firebase AI Logic means only your genuine app can send prompts. Add per-user rate limits and a budget alert, and the “denial of wallet” risk drops sharply.

4. Real Estate, Job and Matrimonial Platforms: Data Scraping

Problem: A property or matrimonial app shows listings and profiles to signed-in users. A competitor creates a few accounts and runs a script that copies every listing, photo and phone number from Firestore and Storage.

With App Check: Firestore and Cloud Storage reject requests that do not come from the genuine app, so bulk copying with scripts stops working. Security rules still decide which profiles each user may see.

5. EdTech and OTT: Paid Content Leaks

Problem: Course videos and PDFs are stored in Cloud Storage. People share download links or use tools to pull content outside the app.

With App Check: Storage only serves files to requests from the genuine app. Combined with rules that check the user’s subscription, paid content stays inside the app.

6. E-commerce Websites: Fake Sign-ups and Review Spam

Problem: Bots fill the sign-up form and post fake reviews on product pages.

With App Check: reCAPTCHA Enterprise scores each visitor silently in the background, with no “click the traffic lights” puzzle for real shoppers. Bot traffic without a valid token cannot write to Firestore.

App Check Pricing and Limits

App Check itself has no separate charge. You only deal with the limits of the provider you choose:

Provider	Free limit
Play Integrity (Android)	10,000 calls per day on the Standard usage tier. You can request a higher tier.
App Attest / DeviceCheck (Apple)	Limits set by Apple
reCAPTCHA Enterprise (Web)	10,000 assessments per month free, paid after that

The SDK caches tokens, so the provider is not called on every request. A longer token lifetime means fewer provider calls; a shorter one means stronger protection but more quota use. For most apps the default works well.

Common App Check Mistakes to Avoid

Enforcing too early: Users on old app versions get locked out. Monitor metrics first.
Wrong SHA-256: Use the Play app signing key fingerprint, not the upload or debug key.
Shipping the debug provider in release: Always switch to Play Integrity for release builds, as in the code above.
Leaking debug tokens: Keep them out of Git and remove unused ones.
Forgetting other apps: Register every app in the project (Android, iOS, web, admin app). After enforcement, unregistered apps are blocked.
Thinking App Check replaces security rules: It does not. Keep strong rules and authentication too.

Conclusion

Firebase App Check answers one simple question for every request: “Did this really come from my app?” It protects your bill, your data and your quotas from scripts, bots and modified apps, and it takes very little code to add.

My advice: add App Check before your next release, watch the metrics for a week or two, then enforce it service by service. Pair it with Authentication, strong security rules and a budget alert, and your Firebase backend will be in much better shape. For full details, see the official App Check documentation.

FAQs

Q1: Is Firebase App Check free?
App Check has no separate charge. Play Integrity’s Standard tier allows 10,000 calls per day, and reCAPTCHA Enterprise gives 10,000 free assessments per month.

Q2: Does App Check replace Firebase Authentication?
No. Authentication identifies the user. App Check verifies the app and device. You should use both, along with security rules.

Q3: Will App Check break my app for existing users?
Not if you follow the right order: release the update, monitor metrics, and enforce only after most requests are verified.

Q4: How do I test App Check on an emulator?
Use the debug provider in debug builds and register the debug token from Logcat in the Firebase console.

Q5: Can App Check protect my own API?
Yes. Send the token in the X-Firebase-AppCheck header and verify it on your server with the Firebase Admin SDK.

Q6: Does App Check stop all hackers?
No security tool stops everyone. App Check makes automated abuse much harder and more expensive, which removes most of the attacks real apps face.

Firebase App Check Tutorial: What It Is, Why to Use It, and How to Set It Up (With Real Industry Examples)