Prevent Gemini API abuse with Firebase App Check

When you call an API directly from a mobile or web app, the API is vulnerable to abuse by unauthorized clients. If you want to call the Gemini API directly from your mobile or web app, you need to help protect it from abuse by using Firebase AI Logic and enforcing Firebase App Check. When you enforce App Check, it will only allow incoming requests that are verified to be from your actual app and/or an untampered device.

Jump to set up instructions

Firebase AI Logic provides a proxy gateway that lets you integrate with Firebase App Check and protect the Gemini API when it's called directly by your mobile and web apps. When App Check is enforced for Firebase AI Logic, it helps protect both the Gemini Developer API and the Agent Platform Gemini API (formerly Vertex AI).

App Check for Firebase AI Logic also supports replay protection, which means an App Check token can only be used once.


High-level summary of how App Check works

With App Check, devices running your app use an app or device attestation provider that verifies one or both of the following:

  • Requests originate from your authentic app
  • Requests originate from an authentic, untampered device

This attestation is attached to every request your app makes using a Firebase AI Logic SDK. When App Check is enforced, requests from clients without a valid attestation will be rejected, as will any request originating from an app or platform you haven't authorized.

When setting up App Check, consider adding replay protection, which makes App Check tokens one-time-use only. This option offers enhanced protection beyond the baseline protection and lets you set an appropriate level of protection for your app and use cases.

You can find detailed information about App Check in its documentation, including descriptions of attestation providers as well as any applicable quotas and limits.

Set up App Check

The following instructions are optimized for setting up Firebase App Check enforcement for Firebase AI Logic.

Step 1: Enforce App Check

Starting in early July 2026, during the guided setup workflow in the Firebase console, Firebase automatically enforces Firebase App Check for Firebase AI Logic to help protect the Gemini API.

However, if you had already set up Firebase AI Logic in your Firebase project before early July 2026 (or App Check isn't enforced for some other reason), then you can enforce App Check yourself using the following instructions.

  1. Check if App Check is already enforced for Firebase AI Logic.

    1. In the Firebase console, go to the Security > App Check > APIs tab.

    2. Find the row for Firebase AI Logic. If it says Unenforced, then continue with the remainder of these instructions.

  2. Click the row for Firebase AI Logic, and you'll see metrics graphs. Below those graphs, click Set up.

  3. In the first screen of the dialog (Baseline protection), select Enforced, and then click Continue.

  4. In the next screen (Replay protection), select Disabled, and then click Continue.

  5. In the final screen, review the considerations for enforcing App Check to make sure that you're ready to enforce App Check. If you're ready, click Continue.

    You do not need to register your apps if you only want to enforce App Check and only use the debug provider with Firebase AI Logic in a pre-production app. However, when you're ready to release your app to end users, then you need to register your apps as part of setting up a production attestation provider (like App Attest, Play Integrity, or reCAPTCHA Enterprise).

Step 2: Set up the debug provider for local development

For local development, you can set up the App Check debug provider and still keep App Check enforced for Firebase AI Logic.

Swift

Here's how to use the debug provider while running your app in a simulator interactively (for example, during local development):

  1. In your Xcode project, import FirebaseAppCheck and initialize App Check with the debug provider factory before you configure Firebase.

    import SwiftUI
import FirebaseCore
import FirebaseAppCheck

@main
struct YourApp: App {
  init() {
    let providerFactory = AppCheckDebugProviderFactory()
    AppCheck.setAppCheckProviderFactory(providerFactory)
    FirebaseApp.configure()
  }

  var body: some Scene {
    WindowGroup {
      NavigationView {
        ContentView()
      }
    }
  }
}

  2. Obtain your debug token:

    1. Launch your app in the simulator or on your test device.

    2. Open the Xcode console and look for the App Check debug token. For example:

      <Warning> [AppCheckCore][I-GAC004001] App Check debug token: '123a4567-b89c-12d3-e456-789012345678'.

    3. Copy the token (for example, 123a4567-b89c-12d3-e456-789012345678).

  3. Register your debug token with App Check:

    1. In the Firebase console, go to the Security > App Check > Apps tab.

    2. Find your app, click the overflow menu (), and then select Manage debug tokens.

    3. Follow the on-screen instructions to register your debug token.

For details about the debug provider (including how to get a new debug token), see the official App Check docs.

Kotlin

Here's how to use the debug provider while running your app in an emulator interactively (for example, during local development):

  1. In your debug build, configure App Check to use the debug provider factory:

    Firebase.initialize(context = this)
Firebase.appCheck.installAppCheckProviderFactory(
    DebugAppCheckProviderFactory.getInstance(),
)

  2. Obtain your debug token:

    1. Run your app in the emulator or on your test device.

    2. Look for the App Check debug token in your logs. For example:

      D DebugAppCheckProvider: Enter this debug secret into the allow list
in the Firebase Console for your project: 123a4567-b89c-12d3-e456-789012345678

    3. Copy the token (for example, 123a4567-b89c-12d3-e456-789012345678).

  3. Register your debug token with App Check:

    1. In the Firebase console, go to the Security > App Check > Apps tab.

    2. Find your app, click the overflow menu (), and then select Manage debug tokens.

    3. Follow the on-screen instructions to register your debug token.

For details about the debug provider (including how to get a new debug token), see the official App Check docs.

Java

Here's how to use the debug provider while running your app in an emulator interactively (for example, during local development):

  1. In your debug build, configure App Check to use the debug provider factory:

    FirebaseApp.initializeApp(/*context=*/ this);
FirebaseAppCheck firebaseAppCheck = FirebaseAppCheck.getInstance();
firebaseAppCheck.installAppCheckProviderFactory(
        DebugAppCheckProviderFactory.getInstance());

  2. Obtain your debug token:

    1. Run your app in the emulator or on your test device.

    2. Look for the App Check debug token in your logs. For example:

      D DebugAppCheckProvider: Enter this debug secret into the allow list
in the Firebase Console for your project: 123a4567-b89c-12d3-e456-789012345678

    3. Copy the token (for example, 123a4567-b89c-12d3-e456-789012345678).

  3. Register your debug token with App Check:

    1. In the Firebase console, go to the Security > App Check > Apps tab.

    2. Find your app, click the overflow menu (), and then select Manage debug tokens.

    3. Follow the on-screen instructions to register your debug token.

For details about the debug provider (including how to get a new debug token), see the official App Check docs.

Web

Here's how to use the debug provider while running your app from localhost interactively (for example, during local development):

  1. In your debug build, enable debug mode by setting self.FIREBASE_APPCHECK_DEBUG_TOKEN to true before you initialize App Check. For example:

    self.FIREBASE_APPCHECK_DEBUG_TOKEN = true;
initializeAppCheck(app, { /* App Check options */ });

  2. Visit your web app locally and open the browser's developer tools. In the debug console, you'll see a debug token:

    AppCheck debug token: "123a4567-b89c-12d3-e456-789012345678".
You will need to safelist it in the Firebase console for it to work.

  3. Register your debug token with App Check:

    1. In the Firebase console, go to the Security > App Check > Apps tab.

    2. Find your app, click the overflow menu (), and then select Manage debug tokens.

    3. Follow the on-screen instructions to register your debug token.

For details about the debug provider (including how to get a new debug token), see the official App Check docs.

Dart

iOS+

Here's how to use the debug provider while running your app in a simulator interactively (for example, during local development):

  1. Activate App Check with the debug provider right after you've initialized your Firebase app:

    import 'package:flutter/material.dart';
import 'package:firebase_core/firebase_core.dart';

// Import the firebase_app_check plugin
import 'package:firebase_app_check/firebase_app_check.dart';

Future<void> main() async {
  WidgetsFlutterBinding.ensureInitialized();
  await Firebase.initializeApp();
  await FirebaseAppCheck.instance.activate(
    // Set appleProvider to `AppleProvider.debug`
    appleProvider: AppleProvider.debug,
  );
  runApp(App());
}

  2. Enable debug logging in your Xcode project:

    1. Open Product > Scheme > Edit scheme.
    2. Select Run from the left menu, and then select the Arguments tab.
    3. In the Arguments Passed on Launch section, add -FIRDebugEnabled.

  3. Obtain your debug token:

    1. Open ios/Runner.xcworkspace with Xcode and run your app in the simulator or on your test device.

    2. Open the Xcode console and look for the App Check debug token. For example:

      <Warning> [AppCheckCore][I-GAC004001] App Check debug token: '123a4567-b89c-12d3-e456-789012345678'.

    3. Copy the token (for example, 123a4567-b89c-12d3-e456-789012345678).

  4. Register your debug token with App Check:

    1. In the Firebase console, go to the Security > App Check > Apps tab.

    2. Find your app, click the overflow menu (), and then select Manage debug tokens.

    3. Follow the on-screen instructions to register your debug token.

Android

Here's how to use the debug provider while running your app in an emulator interactively (for example, during local development):

  1. Activate App Check with the debug provider right after you've initialized your Firebase app:

    import 'package:flutter/material.dart';
import 'package:firebase_core/firebase_core.dart';

// Import the firebase_app_check plugin
import 'package:firebase_app_check/firebase_app_check.dart';

Future<void> main() async {
  WidgetsFlutterBinding.ensureInitialized();
  await Firebase.initializeApp();
  await FirebaseAppCheck.instance.activate(
    // Set androidProvider to `AndroidProvider.debug`
    androidProvider: AndroidProvider.debug,
  );
  runApp(App());
}

  2. Obtain your debug token:

    1. Run your app in the emulator or on your test device.

    2. Look for the App Check debug token in your logs. For example:

      D DebugAppCheckProvider: Enter this debug secret into the allow list
in the Firebase Console for your project: 123a4567-b89c-12d3-e456-789012345678

    3. Copy the token (for example, 123a4567-b89c-12d3-e456-789012345678).

  3. Register your debug token with App Check:

    1. In the Firebase console, go to the Security > App Check > Apps tab.

    2. Find your app, click the overflow menu (), and then select Manage debug tokens.

    3. Follow the on-screen instructions to register your debug token.

Web

Here's how to use the debug provider while running your app from localhost interactively (for example, during local development):

  1. In the file web/index.html, enable debug mode by setting self.FIREBASE_APPCHECK_DEBUG_TOKEN to true:

    <body>
  <script>
    self.FIREBASE_APPCHECK_DEBUG_TOKEN = true;
  </script>

  ...

</body>

  2. Run your web app locally and open the browser's developer tools. In the debug console, you'll see a debug token:

    AppCheck debug token: "123a4567-b89c-12d3-e456-789012345678".
You will need to safelist it in the Firebase console for it to work.

    This token is stored locally in your browser and will be used whenever you use your app in the same browser on the same machine. If you want to use the token in another browser or on another machine, set self.FIREBASE_APPCHECK_DEBUG_TOKEN to the token string instead of true.

  3. Register your debug token with App Check:

    1. In the Firebase console, go to the Security > App Check > Apps tab.

    2. Find your app, click the overflow menu (), and then select Manage debug tokens.

    3. Follow the on-screen instructions to register your debug token.

For details about the debug provider (including how to get a new debug token), see the official App Check docs.

Unity

Here's how to use the debug provider while running your app in an emulator interactively (for example, during local development):

  1. In the Firebase console, create a debug token:

    1. In the Firebase console, go to the Security > App Check > Apps tab.

    2. Find your app, click the overflow menu (), and then select Manage debug tokens.

    3. Follow the on-screen instructions to create a new debug token.

  2. In your app's initialization code, add the following:

    using Firebase.AppCheck;

void InitializeFirebase() {
  // Configure the Debug Provider factory with your debug token.
  DebugAppCheckProviderFactory.Instance.SetDebugToken("YOUR_DEBUG_TOKEN");

  // Set App Check to use the debug provider factory
  FirebaseAppCheck.SetAppCheckProviderFactory(
    DebugAppCheckProviderFactory.Instance);

  // Proceed to initialize Firebase as normal
}

For details about the debug provider (including how to get a new debug token), see the official App Check docs.

Step 3: Set up App Check for end-users and production

When you're ready to release your app to end-users, then you need to register your apps and set up a production attestation provider (like App Attest, Play Integrity, or reCAPTCHA Enterprise).

  1. Choose a production attestation provider, and follow the implementation instructions at the following links:

    Note that if none of these attestation providers are sufficient for your needs, then you can implement a custom provider that uses either a third-party attestation provider or your own attestation techniques.

  2. (Recommended) Enhance protection by adding replay protection, which means an App Check token can only be used once.

Enhance protection by adding replay protection

We recommend using the latest SDK versions, but make sure you're using at minimum one of these versions to use replay protection:
Apple platforms v12.2.0+ | Android BoM v34.14.0+ (App Check v19.1.0+) | Web v12.14.0+ | Flutter v4.15.0+ (App Check v4.10.0+) | Unity v13.12.0+

By default, App Check uses session tokens which have a configurable time to live (TTL) between 30 minutes and 7 days. These session tokens are cached by the App Check SDK, are sent along with requests from your app, and can be re-used until their TTL expires. Using session tokens is considered baseline protection.

However, you can enhance protection beyond this baseline protection by enforcing replay protection, which uses limited-use tokens instead. When replay protection is enforced, the following happens:

  • App Check will block requests to Firebase AI Logic that use session tokens. Instead, App Check will only allow a request to Firebase AI Logic if it uses a newly-minted limited-use token.

  • After the limited-use token is verified, the token is consumed so that it can be used only once, which prevents replay attacks.

  • The App Check SDK generates a new limited-use token for each request. Note that this process can impact your requests by adding some latency and sometimes cost (depending on your attestation provider).

Set up and enforce replay protection

Click your Gemini API provider to view provider-specific content and code on this page.

Here's how to set up and enforce replay protection:

  1. If you haven't already, set up App Check by following the instructions earlier on this page.

  2. Enable usage of limited-use tokens.

    In your app during instantiation, set the useLimitedUseAppCheckTokens parameter to true:

    Swift 

    
// ...

// During instantiation, enable usage of limited-use tokens.
let ai = FirebaseAI.firebaseAI(
  backend: .googleAI(),
  useLimitedUseAppCheckTokens: true
)

// ...

    Kotlin 

    
// ...

// During instantiation, enable usage of limited-use tokens.
val ai = Firebase.ai(
  backend = GenerativeBackend.googleAI(),
  useLimitedUseAppCheckTokens = true
)

// ...

    Java 

    
// ...

// During instantiation, enable usage of limited-use tokens.
FirebaseAI ai = FirebaseAI.getInstance(
  /* backend: */ GenerativeBackend.googleAI(),
  /* useLimitedUseAppCheckTokens: */ true
);

// ...

    Web 

    
// ...

// During instantiation, enable usage of limited-use tokens.
const ai = getAI(firebaseApp, {
  backend: new GoogleAIBackend(),
  useLimitedUseAppCheckTokens: true
});

// ...

    Dart 

    
// ...

// During instantiation, enable usage of limited-use tokens
final ai = await FirebaseAI.googleAI(
  useLimitedUseAppCheckTokens: true,
);

// ...

    Unity 

    // ...

// During instantiation, enable usage of limited-use tokens
var ai = FirebaseAI.GetInstance(
  useLimitedUseAppCheckTokens: true
);

// ...

  3. Enforce replay protection.

    1. In your app's codebase, make sure that you've enabled usage of limited-use tokens (see previous step).

    2. In the Firebase console, go to Security > App Check.

    3. Expand the metrics view for Firebase AI Logic.

    4. Make sure Baseline protection is Enforced, and then click Continue.

    5. For replay protection, choose either Unenforced (monitoring only) or Enforced.

      Consider the following to decide when to enforce replay protection:

      • Monitoring your requests is recommended if a substantial number of your users are likely using earlier versions of your app without usage of limited-use tokens enabled. If you enforce replay protection immediately, requests from those users will be blocked.

      • You can specifically monitor the Unverified: Reused token metric, which is the number of requests that have a token which has already been used in a previous request. Monitor this metric in the Firebase console (go to the Security > App Check > APIs tab).

        If a significant portion of recent requests are in this category, you can avoid disrupting users and consider waiting to enforce replay protection until more users have updated to a version of your app that uses limited-use tokens.

Understand how Firebase AI Logic integrates with App Check

To use the Firebase AI Logic SDKs, the Firebase AI Logic API (firebasevertexai.googleapis.com) must be enabled in your Firebase project. This is because requests made by the Firebase AI Logic SDKs are first sent to the Firebase AI Logic server, which acts as a proxy gateway where Firebase App Check verification takes place before the request is allowed to proceed to your chosen "Gemini API" provider's backend and the APIs to access the Gemini and Imagen models.

FAQ and troubleshooting

Find additional FAQ and troubleshooting or error codes related to Firebase AI Logic.