Firexport / Blog

Every App Check error happens at one of two steps: your app getting a token from its attestation provider (Play Integrity, App Attest, reCAPTCHA), or a Firebase service checking that token. When the first step fails, the second fails too, so don’t stop at the service’s error: look for the token exchange error and fix your platform’s registration. Emulators, simulators and localhost can’t pass attestation at all, so they use a debug token.

Find the failed step from the message

If the app can’t get a token, its service requests carry no valid one (the web SDK sends a placeholder token instead). So when a service rejects requests, check first whether a token exchange error was logged too. After a failure, the SDKs hold off retrying: 24 hours after a 403 or 404 on the web, 24 hours after a 400 or 404 on Android and Apple, and up to 4 hours after other errors. That state lives only in memory, so after you fix the setup, restart the app or reload the page before you check.

Use a debug token while developing

Emulators and simulators don’t count as valid devices, and debug builds that aren’t on Google Play don’t pass Play Integrity. reCAPTCHA keys shouldn’t list localhost. In these environments, turn on the debug provider and register the token it logs in the console.

1. Turn on the debug provider in development builds only.

   // Android (Kotlin): com.google.firebase:firebase-appcheck-debug
   Firebase.appCheck.installAppCheckProviderFactory(
       if (BuildConfig.DEBUG) DebugAppCheckProviderFactory.getInstance()
       else PlayIntegrityAppCheckProviderFactory.getInstance(),
   )
   
   // iOS (Swift): before FirebaseApp.configure()
   #if DEBUG
   AppCheck.setAppCheckProviderFactory(AppCheckDebugProviderFactory())
   #endif
   
   // Web: before initializeAppCheck(), in development builds only
   self.FIREBASE_APPCHECK_DEBUG_TOKEN = true;
   
   // Flutter (firebase_app_check 0.5+)
   await FirebaseAppCheck.instance.activate(
     providerAndroid: kDebugMode
         ? const AndroidDebugProvider()
         : const AndroidPlayIntegrityProvider(),
     providerApple: kDebugMode
         ? const AppleDebugProvider()
         : const AppleAppAttestWithDeviceCheckFallbackProvider(),
   );

2. Run the app and find the debug token in the log. Current SDKs print Firebase App Check debug token: <UUID> (in logcat on Android, the Xcode console on Apple, the browser console on the web).
3. Register it. In the Firebase console, open App Check, go to the Apps tab, and choose Manage debug tokens from your app’s ⋮ menu. Each app can have up to 20.

• Tokens change. A new one is made when you clear the app’s data or reinstall on Android, reinstall on Apple, or use another browser profile or clear site data on the web. Register the new one again.
• In CI, pass a token you registered. Set the token string in self.FIREBASE_APPCHECK_DEBUG_TOKEN on the web, the instrumentation argument firebaseAppCheckDebugSecret on Android, the scheme environment variable AppCheckDebugToken on Apple, and the debugToken parameter in Flutter.
• Treat the token like a password. Don’t commit it, and keep the debug provider and its token out of production builds.

Causes by platform

Android (Play Integrity)

Apple (App Attest, DeviceCheck)

Web (reCAPTCHA)

AI Logic: enforced automatically since November 2, 2026

Since November 2, 2026, Firebase enforces App Check for Firebase AI Logic in projects that weren’t enforcing it. Requests without a valid token are blocked, including those from released app versions without App Check. Two AI Logic errors name App Check:

403 PERMISSION_DENIED: To access this model, you must enforce
Firebase App Check.

403 PERMISSION_DENIED: Firebase AI Logic has been deactivated in this
project. To resume using Firebase AI Logic, you must enforce Firebase
App Check.

• The first means a request without a valid App Check token called a model that’s commonly abused. Set up App Check and enforce it, with the debug provider while developing.
• The second means the project was judged inactive and doesn’t enforce App Check. If you already enforce it and still see this, check replay protection: when it’s on, even in Monitor only mode, only limited-use tokens count.

If versions without App Check are still in users’ hands, you can postpone enforcement. Change the Enforces date on the Firebase AI Logic row in App Check’s APIs tab; January 21, 2027 is the last date allowed. If the row already says Enforced, change the date, then in that row’s Set up set Baseline protection to Unenforced (monitoring only) and replay protection to Disabled. Google advises against this, so ship a version with App Check before then.

Before you enforce it on other services

• Read the metrics first. App Check’s APIs tab splits each service’s requests into Verified, Outdated client (no token), Unknown origin and Invalid. Once enforced, only verified requests get through, so enforce when nearly all recent requests are verified.
• Old app versions get blocked. Versions without the App Check SDK are rejected the moment you enforce.
• It takes up to 15 minutes to apply. Don’t judge the result right after you turn it on.
• Cloud Functions can enforce it on callable functions only. Add enforceAppCheck: true and redeploy. onRequest functions aren’t covered by enforcement, so verify the token yourself with the Admin SDK.

Sources

• App Check overview, enable enforcement, monitor metrics, debug token limit (REST)
• Play Integrity provider, Play Integrity quota, Android debug provider
• App Attest provider, DeviceCheck provider, Apple debug provider, App Attest environment (Apple), where App Attest is supported (Apple)
• reCAPTCHA Enterprise provider, reCAPTCHA v3 provider, create a reCAPTCHA key, web debug provider
• Flutter debug provider, activate() in firebase_app_check
• App Check for AI Logic, AI Logic error codes, App Check for Cloud Functions, verify tokens in your own backend
• SDK source: web throttle, web placeholder token, Storage rejection, Android error message, Android backoff, Apple backoff, callable function rejection