When you call an API directly from a mobile or web app, the API is vulnerable to
abuse by unauthorized clients. **If you want to call the Gemini API directly
from your mobile or web app, you need to help protect it from abuse by using
Firebase AI Logic and
*enforcing [Firebase App Check](https://firebase.google.com/docs/app-check)*** . When you enforce
App Check, it will only allow incoming requests that are verified to be from
your actual app and/or an untampered device.
[Video](https://www.youtube.com/watch?v=YoZhjftm6v4)

[Jump to set up instructions](https://firebase.google.com/docs/ai-logic/app-check#set-up-app-check)

Firebase AI Logic provides a proxy gateway that lets you integrate with
Firebase App Check and protect the Gemini API when it's called directly
by your mobile and web apps. When App Check is enforced for
Firebase AI Logic, it helps protect both the Gemini Developer API
and the Agent Platform Gemini API (formerly Vertex AI).

App Check for Firebase AI Logic also supports
[*replay protection*](https://firebase.google.com/docs/ai-logic/app-check#replay-protection), which means an App Check token
can only be used once.

<br />

> [!CAUTION]
>
> **It's *critical* that App Check is enforced as early as
> possible** --- especially before you commit your app to a publicly
> available source code control system, share your app, or make your app
> publicly available.
>
>
> Starting in early July 2026, during the setup workflow in the
> Firebase console, Firebase automatically enforces App Check for
> Firebase AI Logic.
> If you had already set up Firebase AI Logic in your Firebase project
> *before* early July 2026 (or App Check isn't enforced for some
> other reason), then you can
> [enforce App Check](https://firebase.google.com/docs/ai-logic/app-check#set-up-app-check)
> yourself. For an easier getting started experience or for local
> development, you can enforce App Check and then set up the App Check
> *debug provider*.
>
>
> **Starting November 2, 2026, Firebase App Check enforcement will
> be *required* to use Firebase AI Logic.**
> [Learn more.](https://firebase.google.com/docs/ai-logic/faq-and-troubleshooting#security-app-check)

## High-level summary of how App Check works

With App Check, devices running your app use an app or device attestation
provider that verifies one or both of the following:

- Requests originate from your authentic app
- Requests originate from an authentic, untampered device

This attestation is attached to every request your app makes using a
Firebase AI Logic SDK. When App Check is enforced, requests from clients
without a valid attestation will be rejected, as will any request originating
from an app or platform you haven't authorized.

When setting up App Check, consider adding
[*replay protection*](https://firebase.google.com/docs/ai-logic/app-check#replay-protection), which makes App Check tokens
*one-time-use only*. This option offers enhanced protection beyond the baseline
protection and lets you set an appropriate level of protection for your app and
use cases.

You can find [detailed information about App Check](https://firebase.google.com/docs/app-check) in its
documentation, including descriptions of attestation providers as well as any
applicable [quotas and limits](https://firebase.google.com/docs/app-check#quotas_limits).

## Set up App Check

The following instructions are optimized for setting up Firebase App Check
enforcement for Firebase AI Logic.

### **Step 1** : Enforce App Check

Starting in early July 2026, during the guided setup workflow in the
Firebase console, Firebase automatically enforces Firebase App Check
for Firebase AI Logic to help protect the Gemini API.

However, if you had already set up Firebase AI Logic in your Firebase
project *before* early July 2026 (or App Check isn't enforced for some other
reason), then you can enforce App Check yourself using the following
instructions.

1. Check if App Check is already enforced for Firebase AI Logic.

   1. In the Firebase console, go to the **Security** \> **App Check** \>
      [**APIs** tab](https://console.firebase.google.com/project/_/appcheck/apps/products/?useAutoProject=true).

   2. Find the row for **Firebase AI Logic** . If it says `Unenforced`,
      then continue with the remainder of these instructions.

2. Click the row for Firebase AI Logic, and you'll see metrics graphs.
   Below those graphs, click **Set up**.

3. In the first screen of the dialog (**Baseline protection** ), select
   **Enforced** , and then click **Continue**.

4. In the next screen (**Replay protection** ), select **Disabled** , and then
   click **Continue**.

   > [!NOTE]
   > **Note:** [Setting up *replay protection*](https://firebase.google.com/docs/ai-logic/app-check#replay-protection) requires that you've enabled limited-use tokens in your app. Once you've done that, you can come back later to the Firebase console and set up replay protection options.

5. In the final screen, review the considerations for enforcing App Check
   to make sure that you're ready to enforce App Check. If you're ready,
   click **Continue**.

   You do ***not*** need to register your apps if you only want to enforce
   App Check and *only* use the debug provider with Firebase AI Logic
   in a pre-production app. However, when you're ready to release your app to
   end users, then you need to register your apps as part of setting up a
   production attestation provider (like App Attest, Play Integrity, or
   reCAPTCHA Enterprise).

### **Step 2**: Set up the debug provider for local development

For **local development** , you can set up the App Check *debug provider* and
still keep App Check enforced for Firebase AI Logic.

> [!CAUTION]
> **Keep your debug token and debug build private.** Don't commit your debug token to a public repository, and don't ship your debug token or debug build in production builds of your app.

### Swift

Here's how to use the debug provider while running your app in a simulator
interactively (for example, during local development):

1. In your Xcode project, import `FirebaseAppCheck` and initialize
   App Check with the debug provider factory *before* you configure
   `Firebase`.

       import SwiftUI
       import FirebaseCore
       import FirebaseAppCheck

       @main
       struct YourApp: App {
         init() {
           let providerFactory = AppCheckDebugProviderFactory()
       AppCheck.setAppCheckProviderFactory(providerFactory)
           FirebaseApp.configure()
         }

         var body: some Scene {
           WindowGroup {
             NavigationView {
               ContentView()
             }
           }
         }
       }

2. Obtain your debug token:

   1. Launch your app in the simulator or on your test device.

   2. Open the Xcode console and look for the App Check debug token.
      For example:

          <Warning> [AppCheckCore][I-GAC004001] App Check debug token: '123a4567-b89c-12d3-e456-789012345678'.

   3. Copy the token (for example, `123a4567-b89c-12d3-e456-789012345678`).

3. Register your debug token with App Check:

   1. In the Firebase console, go to the
      **Security** \> **App Check** \>
      [**Apps** tab](https://console.firebase.google.com/project/_/appcheck/apps/?useAutoProject=true).

   2. Find your app, click the overflow menu
      (), and then select
      **Manage debug tokens**.

   3. Follow the on-screen instructions to register your debug token.

For details about the debug provider (including how to get a new debug token),
see the
[official App Check docs](https://firebase.google.com/docs/app-check/ios/debug-provider).

### Kotlin

Here's how to use the debug provider while running your app in an emulator
interactively (for example, during local development):

1. In your debug build, configure App Check to use the debug provider
   factory:

   ```kotlin
   Firebase.initialize(context = this)
   Firebase.appCheck.installAppCheckProviderFactory(
       DebugAppCheckProviderFactory.getInstance(),
   )
   ```
2. Obtain your debug token:

   1. Run your app in the emulator or on your test device.

   2. Look for the App Check debug token in your logs. For example:

          D DebugAppCheckProvider: Enter this debug secret into the allow list
          in the Firebase Console for your project: 123a4567-b89c-12d3-e456-789012345678

   3. Copy the token (for example, `123a4567-b89c-12d3-e456-789012345678`).

3. Register your debug token with App Check:

   1. In the Firebase console, go to the
      **Security** \> **App Check** \>
      [**Apps** tab](https://console.firebase.google.com/project/_/appcheck/apps/?useAutoProject=true).

   2. Find your app, click the overflow menu
      (), and then select
      **Manage debug tokens**.

   3. Follow the on-screen instructions to register your debug token.

For details about the debug provider (including how to get a new debug token),
see the
[official App Check docs](https://firebase.google.com/docs/app-check/android/debug-provider).

### Java

Here's how to use the debug provider while running your app in an emulator
interactively (for example, during local development):

1. In your debug build, configure App Check to use the debug provider
   factory:

   ```java
   FirebaseApp.initializeApp(/*context=*/ this);
   FirebaseAppCheck firebaseAppCheck = FirebaseAppCheck.getInstance();
   firebaseAppCheck.installAppCheckProviderFactory(
           DebugAppCheckProviderFactory.getInstance());
   ```
2. Obtain your debug token:

   1. Run your app in the emulator or on your test device.

   2. Look for the App Check debug token in your logs. For example:

          D DebugAppCheckProvider: Enter this debug secret into the allow list
          in the Firebase Console for your project: 123a4567-b89c-12d3-e456-789012345678

   3. Copy the token (for example, `123a4567-b89c-12d3-e456-789012345678`).

3. Register your debug token with App Check:

   1. In the Firebase console, go to the
      **Security** \> **App Check** \>
      [**Apps** tab](https://console.firebase.google.com/project/_/appcheck/apps/?useAutoProject=true).

   2. Find your app, click the overflow menu
      (), and then select
      **Manage debug tokens**.

   3. Follow the on-screen instructions to register your debug token.

For details about the debug provider (including how to get a new debug token),
see the
[official App Check docs](https://firebase.google.com/docs/app-check/android/debug-provider).

### Web

Here's how to use the debug provider while running your app from `localhost`
interactively (for example, during local development):

> [!WARNING]
> **Warning:** Do ***not*** try to enable `localhost` debugging by adding `localhost` to the allowed domains for reCAPTCHA. Doing so would allow anyone to run your app from their local machines!

1. In your debug build, enable debug mode by setting
   `self.FIREBASE_APPCHECK_DEBUG_TOKEN` to `true` before you initialize
   App Check. For example:

       self.FIREBASE_APPCHECK_DEBUG_TOKEN = true;
       initializeAppCheck(app, { /* App Check options */ });

2. Visit your web app locally and open the browser's developer tools. In the
   debug console, you'll see a debug token:

       AppCheck debug token: "123a4567-b89c-12d3-e456-789012345678".
       You will need to safelist it in the Firebase console for it to work.

3. Register your debug token with App Check:

   1. In the Firebase console, go to the
      **Security** \> **App Check** \>
      [**Apps** tab](https://console.firebase.google.com/project/_/appcheck/apps/?useAutoProject=true).

   2. Find your app, click the overflow menu
      (), and then select
      **Manage debug tokens**.

   3. Follow the on-screen instructions to register your debug token.

For details about the debug provider (including how to get a new debug token),
see the
[official App Check docs](https://firebase.google.com/docs/app-check/web/debug-provider).

### Dart

### iOS+

Here's how to use the debug provider while running your app in a simulator
interactively (for example, during local development):

1. Activate App Check with the debug provider right after you've
   initialized your Firebase app:

       import 'package:flutter/material.dart';
       import 'package:firebase_core/firebase_core.dart';

       // Import the firebase_app_check plugin
       import 'package:firebase_app_check/firebase_app_check.dart';

       Future<void> main() async {
         WidgetsFlutterBinding.ensureInitialized();
         await Firebase.initializeApp();
         await FirebaseAppCheck.instance.activate(
           // Set appleProvider to `AppleProvider.debug`
           appleProvider: AppleProvider.debug,
         );
         runApp(App());
       }

2. Enable debug logging in your Xcode project:

   1. Open **Product \> Scheme \> Edit scheme**.
   2. Select **Run** from the left menu, and then select the **Arguments** tab.
   3. In the **Arguments Passed on Launch** section, add `-FIRDebugEnabled`.
3. Obtain your debug token:

   1. Open `ios/Runner.xcworkspace` with Xcode and run your app in the
      simulator or on your test device.

   2. Open the Xcode console and look for the App Check debug token.
      For example:

          <Warning> [AppCheckCore][I-GAC004001] App Check debug token: '123a4567-b89c-12d3-e456-789012345678'.

   3. Copy the token (for example,
      `123a4567-b89c-12d3-e456-789012345678`).

4. Register your debug token with App Check:

   1. In the Firebase console, go to the
      **Security** \> **App Check** \>
      [**Apps** tab](https://console.firebase.google.com/project/_/appcheck/apps/?useAutoProject=true).

   2. Find your app, click the overflow menu
      (), and then select
      **Manage debug tokens**.

   3. Follow the on-screen instructions to register your debug token.

### Android

Here's how to use the debug provider while running your app in an emulator
interactively (for example, during local development):

1. Activate App Check with the debug provider right after you've
   initialized your Firebase app:

       import 'package:flutter/material.dart';
       import 'package:firebase_core/firebase_core.dart';

       // Import the firebase_app_check plugin
       import 'package:firebase_app_check/firebase_app_check.dart';

       Future<void> main() async {
         WidgetsFlutterBinding.ensureInitialized();
         await Firebase.initializeApp();
         await FirebaseAppCheck.instance.activate(
           // Set androidProvider to `AndroidProvider.debug`
           androidProvider: AndroidProvider.debug,
         );
         runApp(App());
       }

2. Obtain your debug token:

   1. Run your app in the emulator or on your test device.

   2. Look for the App Check debug token in your logs. For example:

          D DebugAppCheckProvider: Enter this debug secret into the allow list
          in the Firebase Console for your project: 123a4567-b89c-12d3-e456-789012345678

   3. Copy the token (for example,
      `123a4567-b89c-12d3-e456-789012345678`).

3. Register your debug token with App Check:

   1. In the Firebase console, go to the
      **Security** \> **App Check** \>
      [**Apps** tab](https://console.firebase.google.com/project/_/appcheck/apps/?useAutoProject=true).

   2. Find your app, click the overflow menu
      (), and then select
      **Manage debug tokens**.

   3. Follow the on-screen instructions to register your debug token.

### Web

Here's how to use the debug provider while running your app from
`localhost` interactively (for example, during local development):

> [!WARNING]
> **Warning:** Do ***not*** try to enable `localhost` debugging by adding `localhost` to the allowed domains for reCAPTCHA. Doing so would allow anyone to run your app from their local machines!

1. In the file `web/index.html`, enable debug mode by setting
   `self.FIREBASE_APPCHECK_DEBUG_TOKEN` to `true`:

       <body>
         <script>
           self.FIREBASE_APPCHECK_DEBUG_TOKEN = true;
         </script>

         ...

       </body>

2. Run your web app locally and open the browser's developer tools. In
   the debug console, you'll see a debug token:

       AppCheck debug token: "123a4567-b89c-12d3-e456-789012345678".
       You will need to safelist it in the Firebase console for it to work.

   This token is stored locally in your browser and will be used whenever
   you use your app in the same browser on the same machine. If you want
   to use the token in another browser or on another machine, set
   `self.FIREBASE_APPCHECK_DEBUG_TOKEN` to the token string instead of
   `true`.
3. Register your debug token with App Check:

   1. In the Firebase console, go to the
      **Security** \> **App Check** \>
      [**Apps** tab](https://console.firebase.google.com/project/_/appcheck/apps/?useAutoProject=true).

   2. Find your app, click the overflow menu
      (), and then select
      **Manage debug tokens**.

   3. Follow the on-screen instructions to register your debug token.

For details about the debug provider (including how to get a new debug token),
see the
[official App Check docs](https://firebase.google.com/docs/app-check/flutter/debug-provider).

### Unity

Here's how to use the debug provider while running your app in an emulator
interactively (for example, during local development):

1. In the Firebase console, create a debug token:

   1. In the Firebase console, go to the **Security** \> **App Check** \>
      [**Apps** tab](https://console.firebase.google.com/project/_/appcheck/apps/?useAutoProject=true).

   2. Find your app, click the overflow menu
      (), and then select
      **Manage debug tokens**.

   3. Follow the on-screen instructions to create a new debug token.

2. In your app's initialization code, add the following:

       using Firebase.AppCheck;

       void InitializeFirebase() {
         // Configure the Debug Provider factory with your debug token.
         DebugAppCheckProviderFactory.Instance.SetDebugToken("YOUR_DEBUG_TOKEN");

         // Set App Check to use the debug provider factory
         FirebaseAppCheck.SetAppCheckProviderFactory(
           DebugAppCheckProviderFactory.Instance);

         // Proceed to initialize Firebase as normal
       }

For details about the debug provider (including how to get a new debug token),
see the
[official App Check docs](https://firebase.google.com/docs/app-check/unity/debug-provider).

### **Step 3** : Set up App Check for end-users and production

When you're ready to release your app to end-users, then you need to register
your apps and set up a *production attestation provider* (like App Attest, Play
Integrity, or reCAPTCHA Enterprise).

1. Choose a production attestation provider, and follow the implementation
   instructions at the following links:

   - **Apple platforms** : [DeviceCheck](https://firebase.google.com/docs/app-check/ios/devicecheck-provider) or [App Attest](https://firebase.google.com/docs/app-check/ios/app-attest-provider) or [reCAPTCHA Enterprise](https://firebase.google.com/docs/app-check/ios/recaptcha-enterprise-provider)
   - **Android** : [Play Integrity](https://firebase.google.com/docs/app-check/android/play-integrity-provider) or [reCAPTCHA Enterprise](https://firebase.google.com/docs/app-check/android/recaptcha-enterprise-provider)
   - **Web** : [reCAPTCHA Enterprise](https://firebase.google.com/docs/app-check/web/recaptcha-enterprise-provider)
   - **Flutter** : Supports [all the providers above](https://firebase.google.com/docs/app-check/flutter/default-providers), including [reCAPTCHA Enterprise](https://firebase.google.com/docs/app-check/flutter/recaptcha-enterprise-provider)  
     If you're using older plugin versions, see the [note about special instantiation](https://firebase.google.com/docs/ai-logic/app-check#instantiation-flutter) below for Flutter and App Check.
   - **Unity** : Supports [all the providers above](https://firebase.google.com/docs/app-check/unity/default-providers) (support for reCAPTCHA Enterprise is coming soon)

   Note that if none of these attestation providers are sufficient for your
   needs, then you can
   [implement a custom provider](https://firebase.google.com/docs/app-check/custom-provider) that uses
   either a third-party attestation provider or your own attestation
   techniques.
2. *(Recommended)*
   [Enhance protection by adding ***replay protection***](https://firebase.google.com/docs/ai-logic/app-check#replay-protection),
   which means an App Check token can only be used once.

<br />

**Special instantiation required for Flutter if using older plugin versions**

<br />

|---|
| *Click your Gemini API provider to view provider-specific content and code on this page.* <button value="dev" default="">Gemini Developer API</button> <button value="vertex">Vertex AI Gemini API</button> |

This special instantiation is only required if your app uses the Flutter plugin
`firebase_ai` v3.11.0 or lower (BoM v4.12.0 or lower). If your app uses a newer
version of the plugin, this special instantiation isn't needed.

> [!NOTE]
> **Note:** Firebase recommends using the [latest versions of SDKs, plugins, and tools](https://firebase.google.com/support/releases#latest-versions) so that you have access to the latest features, bug fixes, etc.

If you enforce App Check, then in Flutter apps that use older plugin
versions, you need to explicitly pass in App Check during instantiation,
like so:


    // ...

    // During instantiation, enable usage of limited-use tokens
    final ai = await FirebaseAI.googleAI(
      // For Flutter plugin v3.11.0 or lower (BoM v4.12.0 or lower), pass in App Check explicitly.
      appCheck: FirebaseAppCheck.instance,
      useLimitedUseAppCheckTokens: true,
    );

    // ...

<br />

<br />

## Enhance protection by adding replay protection

|---|
| **We recommend using the latest SDK versions, but *make sure you're using at minimum one of these versions to use replay protection:*** Apple platforms v12.2.0+ \| Android BoM v34.14.0+ (App Check v19.1.0+) \| Web v12.14.0+ \| Flutter v4.15.0+ (App Check v4.10.0+) \| Unity v13.12.0+ |

By default, App Check uses *session tokens* which have a configurable
time to live (TTL) between 30 minutes and 7 days.
These session tokens are cached by the App Check SDK, are sent along with
requests from your app, and can be re-used until their TTL expires. Using
session tokens is considered *baseline protection*.

However, you can enhance protection beyond this baseline protection by enforcing
*replay protection* , which uses *limited-use tokens* instead. When replay
protection is enforced, the following happens:

- App Check will block requests to Firebase AI Logic that use
  *session tokens* . Instead, App Check will only **allow** a request to
  Firebase AI Logic if it uses a ***newly-minted limited-use token***.

- After the limited-use token is verified, the token is consumed so that it can
  be used only once, which prevents replay attacks.

- The App Check SDK generates a new limited-use token for *each* request.
  Note that this process can impact your requests by adding some latency and
  sometimes cost (depending on your attestation provider).

### Set up and enforce replay protection

|---|
| *Click your Gemini API provider to view provider-specific content and code on this page.* <button value="dev" default="">Gemini Developer API</button> <button value="vertex">Agent Platform Gemini API</button> |

Here's how to set up and enforce replay protection:

1. If you haven't already,
   [set up App Check](https://firebase.google.com/docs/ai-logic/app-check#set-up-app-check) by
   following the instructions earlier on this page.

2. **Enable usage of limited-use tokens.**

   In your app during instantiation, set the `useLimitedUseAppCheckTokens`
   parameter to `true`:

   ### Swift


       // ...

       // During instantiation, enable usage of limited-use tokens.
       let ai = FirebaseAI.firebaseAI(
         backend: .googleAI(),
         useLimitedUseAppCheckTokens: true
       )

       // ...

   ### Kotlin


       // ...

       // During instantiation, enable usage of limited-use tokens.
       val ai = Firebase.ai(
         backend = GenerativeBackend.googleAI(),
         useLimitedUseAppCheckTokens = true
       )

       // ...

   ### Java


       // ...

       // During instantiation, enable usage of limited-use tokens.
       FirebaseAI ai = FirebaseAI.getInstance(
         /* backend: */ GenerativeBackend.googleAI(),
         /* useLimitedUseAppCheckTokens: */ true
       );

       // ...

   ### Web


       // ...

       // During instantiation, enable usage of limited-use tokens.
       const ai = getAI(firebaseApp, {
         backend: new GoogleAIBackend(),
         useLimitedUseAppCheckTokens: true
       });

       // ...

   ### Dart


       // ...

       // During instantiation, enable usage of limited-use tokens
       final ai = await FirebaseAI.googleAI(
         useLimitedUseAppCheckTokens: true,
       );

       // ...

   ### Unity

       // ...

       // During instantiation, enable usage of limited-use tokens
       var ai = FirebaseAI.GetInstance(
         useLimitedUseAppCheckTokens: true
       );

       // ...

   > [!NOTE]
   > **Note:** Consider setting up limited-use tokens to be a Firebase Remote Config parameter so that you can control its setting remotely rather than having it hard-coded in your app. Learn more about [using Remote Config](https://firebase.google.com/docs/ai-logic/solutions/remote-config).

3. **Enforce replay protection.**

   1. In your app's codebase, make sure that you've enabled usage of
      limited-use tokens (see previous step).

   2. In the Firebase console, go to **Security** \>
      [**App Check**](https://console.firebase.google.com/project/_/appcheck/?useAutoProject=true).

   3. Expand the metrics view for Firebase AI Logic.

   4. Make sure *Baseline protection* is **Enforced** , and then click
      **Continue**.

   5. For replay protection, choose either **Unenforced (monitoring only)**
      or **Enforced**.

      Consider the following to decide when to enforce replay protection:
      - Monitoring your requests is recommended if a substantial number of
        your users are likely using earlier versions of your app without
        usage of limited-use tokens enabled. If you enforce replay
        protection immediately, requests from those users will be blocked.

      - You can specifically monitor the **Unverified: Reused token**
        metric, which is the number of requests that have a token which has
        already been used in a previous request. Monitor this metric in the
        Firebase console (go to the **Security** \> **App Check** \>
        [**APIs** tab](https://console.firebase.google.com/project/_/appcheck/products/?useAutoProject=true)).

        If a significant portion of recent requests are in this category,
        you can avoid disrupting users and consider waiting to enforce
        replay protection until more users have updated to a version of your
        app that uses limited-use tokens.

> [!NOTE]
> **Note** : Be aware of the following if you ***only** enable usage of limited-use tokens* , and you do *not* enforce replay protection:
>
> - Limited-use tokens have a TTL of only 5 minutes, and the TTL isn't adjustable (unlike session tokens). *When replay protection isn't
>   enforced*, limited-use tokens are similar to session tokens in that they can be re-used until their TTL expires.
> - Even though limited-use tokens are valid for 5 minutes, the SDK will still generate a new token for *each* request. Also, the SDKs do *not* cache limited-use tokens.
> - *When replay protection isn't enforced* , App Check will *not* block requests to Firebase AI Logic that use *valid session tokens*.

## Understand how Firebase AI Logic integrates with App Check

To use the Firebase AI Logic SDKs, the
[Firebase AI Logic API (`firebasevertexai.googleapis.com`)](https://console.cloud.google.com/apis/library/firebasevertexai.googleapis.com?project=_)
must be enabled in your Firebase project. This is because requests made by the
Firebase AI Logic SDKs are first sent to the Firebase AI Logic
server, which acts as a proxy gateway where Firebase App Check verification
takes place *before* the request is allowed to proceed to the Gemini API and
access the Gemini models.

## FAQ and troubleshooting

Find additional
[FAQ and troubleshooting](https://firebase.google.com/docs/ai-logic/faq-and-troubleshooting) or
[error codes](https://firebase.google.com/docs/ai-logic/error-codes) related to Firebase AI Logic.

<br />

#### Do I need App Check enforced for all versions of my app?

<br />

App Check needs to be enforced for all versions of your app that use
Firebase AI Logic.

It's critical that App Check is enforced as early as possible --- especially
before you commit your app to a publicly available source code control system,
share your app, or make your app publicly available.

If you implement App Check in your app's codebase right away, then all your
app versions can send valid App Check tokens. A request that doesn't send a
valid token is considered unverified and will be blocked when App Check is
enforced.

If you've already released a version of your app to end-users that does *not*
have App Check implemented, see the FAQ about how to
[implement and enforce App Check for an already released app](https://firebase.google.com/docs/ai-logic/app-check#app-check-for-already-released-app).

<br />

<br />

<br />

#### How do I implement and enforce App Check for an app that's already released?

<br />

For app versions that don't have App Check implemented, requests to
Firebase AI Logic from those versions don't have valid App Check tokens
and are considered unverified. These requests will be blocked when App Check
is enforced for Firebase AI Logic.

> [!WARNING]
> **Warning:** **Starting November 2, 2026, App Check enforcement for
> Firebase AI Logic will be required.**   
> On this date, we'll automatically enforce App Check for Firebase AI Logic, and it can't be unenforced. If you have end-users on app versions that don't have App Check implemented, then requests from those users will be blocked. Thus, it's critical that you migrate these end-users to app versions with App Check implemented as soon as possible.

The following instructions help you migrate your app so that you can enforce
App Check in a way that avoids service disruptions for an already released
app that doesn't have App Check.

1. Implement a *production attestation provider* in your app as soon as
   possible.

   - **Apple platforms** : [DeviceCheck](https://firebase.google.com/docs/app-check/ios/devicecheck-provider) or [App Attest](https://firebase.google.com/docs/app-check/ios/app-attest-provider) or [reCAPTCHA Enterprise](https://firebase.google.com/docs/app-check/ios/recaptcha-enterprise-provider)
   - **Android** : [Play Integrity](https://firebase.google.com/docs/app-check/android/play-integrity-provider) or [reCAPTCHA Enterprise](https://firebase.google.com/docs/app-check/android/recaptcha-enterprise-provider)
   - **Web** : [reCAPTCHA Enterprise](https://firebase.google.com/docs/app-check/web/recaptcha-enterprise-provider)
   - **Flutter** : Supports [all the providers above](https://firebase.google.com/docs/app-check/flutter/default-providers), including [reCAPTCHA Enterprise](https://firebase.google.com/docs/app-check/flutter/recaptcha-enterprise-provider)
   - **Unity** : Supports [all the providers above](https://firebase.google.com/docs/app-check/unity/default-providers) (support for reCAPTCHA Enterprise is coming soon)

   > [!NOTE]
   > **Note:** When you implement App Check, consider enabling usage of limited-use tokens so that you have the option later of [enhanced protection using *replay protection*](https://firebase.google.com/docs/ai-logic/app-check#replay-protection), which means an App Check token can only be used once.

2. [Monitor the requests from your app](https://firebase.google.com/docs/app-check/monitor-metrics) to
   help you decide when it's safe to enforce App Check.

   For example, if almost all of the recent requests are from verified clients,
   then you should consider enforcing App Check.
3. [Enforce App Check for Firebase AI Logic.](https://firebase.google.com/docs/ai-logic/app-check#enforce-app-check)

   > [!WARNING]
   > **Warning:** If you haven't enforced App Check for Firebase AI Logic by November 2, 2026, it will be *automatically* enforced. [Learn more.](https://firebase.google.com/docs/ai-logic/faq-and-troubleshooting#security-app-check)

4. For **local development** when App Check is enforced, you can
   [set up the App Check *debug provider*](https://firebase.google.com/docs/ai-logic/app-check#configure-debug-provider)
   and still keep App Check enforced for Firebase AI Logic.

<br />

<br />

<br />

#### **403 error** : `PERMISSION_DENIED: To access this model, you must enforce Firebase App Check. Learn more: https://firebase.google.com/docs/ai-logic/app-check`

<br />

If you receive a `403 - PERMISSION_DENIED` error that says
`To access this model, you must enforce Firebase App Check. Learn more: https://firebase.google.com/docs/ai-logic/app-check`,
it means that your request doesn't have a valid App Check token and you're
attempting to access a model that's commonly abused.

Some generative models have been identified as common for malicious actors to
abuse.

Because you don't have App Check enforced for Firebase AI Logic, your
project is vulnerable to abuse of these models. To help protect our developers,
Firebase blocks access to these models unless the request includes a valid
App Check token (meaning App Check is enforced for
Firebase AI Logic).

> [!WARNING]
> **Warning:** **Starting November 2, 2026, Firebase App Check enforcement will be
> *required* to use Firebase AI Logic** . [Learn more.](https://firebase.google.com/docs/ai-logic/faq-and-troubleshooting#security-app-check)

If you want to access the model that returned the error, do the following:

1. [**Set up App Check for Firebase AI Logic.**](https://firebase.google.com/docs/ai-logic/app-check#set-up-app-check)
   For local development, make sure that you set up the
   App Check *debug provider*.

   Enforcing App Check is critical to help protect the Gemini API and
   Gemini models from abuse, and its enforcement is required to clear
   this error.
2. **Resend the request from your app to Firebase AI Logic.**

   This request will send along a valid App Check token, and you'll no
   longer get this `403 - PERMISSION_DENIED` error.
3. Before you release your app to end-users, you need to
   [**set up a production attestation provider**](https://firebase.google.com/docs/ai-logic/app-check#configure-for-production)
   (like App Attest, Play Integrity, or reCAPTCHA Enterprise) so that
   your end-users can access your AI feature when App Check is enforced.

<br />

<br />

<br />

#### **403 error** : `PERMISSION_DENIED: Firebase AI Logic has been deactivated in this project. To resume using Firebase AI Logic, you must enforce Firebase App Check. Learn more: https://firebase.google.com/docs/ai-logic/app-check`

<br />

If you receive a `403 - PERMISSION_DENIED` error that says
`Firebase AI Logic has been deactivated in this project. To resume using
Firebase AI Logic, you must enforce Firebase App Check. Learn more:
https://firebase.google.com/docs/ai-logic/app-check`,
it means that your Firebase project has been identified as inactive and you
don't have App Check enforced for Firebase AI Logic.

"Inactive projects" are those that have Firebase AI Logic enabled, but don't
have any recent usage of Firebase AI Logic.

Because you don't have App Check enforced for Firebase AI Logic, your
project is vulnerable to abuse of the Gemini API. To help protect your
project, Firebase deactivated usage of Firebase AI Logic until you enforce
App Check for Firebase AI Logic.

> [!WARNING]
> **Warning:** **Starting November 2, 2026, Firebase App Check enforcement will be
> *required* to use Firebase AI Logic** . [Learn more.](https://firebase.google.com/docs/ai-logic/faq-and-troubleshooting#security-app-check)

When you're ready to start using Firebase AI Logic again, do the
following:

1. [**Set up App Check for Firebase AI Logic.**](https://firebase.google.com/docs/ai-logic/app-check#set-up-app-check)
   For local development, make sure that you set up the
   App Check *debug provider*.

   Enforcing App Check is critical to help protect the Gemini API and
   Gemini models from abuse, and its enforcement is required to clear
   this error.
2. **Resend the request from your app to Firebase AI Logic.**

   This request will send along a valid App Check token, and you'll no
   longer get this `403 - PERMISSION_DENIED` error.
3. **If you already enforce App Check and still get this error, check
   whether [replay protection](https://firebase.google.com/docs/ai-logic/app-check#replay-protection) is
   turned on for Firebase AI Logic** (including in "Monitor only" mode).

   When replay protection is on, only *limited-use tokens* count as verified
   for Firebase AI Logic; regular session tokens don't clear this error.
   Either
   [enable limited-use tokens in your app](https://firebase.google.com/docs/ai-logic/app-check#set-up-replay-protection),
   or turn replay protection off for Firebase AI Logic, resend a request,
   and wait about a day before turning replay protection back on (project
   activity is re-evaluated daily).
4. Before you release your app to end-users, you need to
   [**set up a production attestation provider**](https://firebase.google.com/docs/ai-logic/app-check#configure-for-production)
   (like App Attest, Play Integrity, or reCAPTCHA Enterprise) so that
   your end-users can access your AI feature when App Check is enforced.

<br />

<br />

<br />

#### Enforce App Check without a production attestation provider (debug provider only)

<br />

You can enforce App Check for Firebase AI Logic without registering your
app with a production attestation provider. Instead, you can set up the
App Check *debug provider* . This setup is helpful for local development or
if you're just getting started with or trying out Firebase AI Logic.

Earlier on this page, you can find optimized instructions for
[setting up App Check for Firebase AI Logic](https://firebase.google.com/docs/ai-logic/app-check#set-up-app-check),
including enforcing App Check and setting up the
App Check *debug provider*.

> [!IMPORTANT]
> **Important:** Before you release your app to end-users, you need to [set up a production attestation provider](https://firebase.google.com/docs/ai-logic/app-check#configure-for-production) (like App Attest, Play Integrity, or reCAPTCHA Enterprise) so that your end-users can access your AI feature when App Check is enforced.

<br />

<br />

<br />

#### Unenforce App Check (strongly **NOT** recommended)

<br />

> [!WARNING]
> **Warning:** **Unenforcing App Check for Firebase AI Logic is
> *strongly NOT recommended*** . When App Check isn't enforced for Firebase AI Logic, the Gemini API is vulnerable to abuse.  
>
> However, if you choose to unenforce App Check, ***it's critical that you
> [enforce it again](https://firebase.google.com/docs/ai-logic/app-check#enforce-app-check)*** --- especially before you commit your app to a publicly available source code control system, share your app, or make your app publicly available.  
>
> If you're unenforcing App Check because you're just getting started with or trying out Firebase AI Logic, then you should strongly consider [setting up the *debug provider* for local development](https://firebase.google.com/docs/ai-logic/app-check#configure-debug-provider) instead of unenforcing App Check.  
>
> **Starting November 2, 2026, Firebase App Check enforcement will be
> required to use Firebase AI Logic, and you won't be able to unenforce it.
> [Learn more.](https://firebase.google.com/docs/ai-logic/faq-and-troubleshooting#security-app-check)**

1. Check if App Check is enforced for Firebase AI Logic.

   1. In the Firebase console, go to the **Security** \> **App Check** \>
      [**APIs** tab](https://console.firebase.google.com/project/_/appcheck/apps/products/?useAutoProject=true).

   2. Find the row for **Firebase AI Logic** . If it says `Enforced`,
      then continue with the remainder of these instructions.

2. Click the row for Firebase AI Logic, and you'll see metrics graphs.
   Below those graphs, click **Set up**.

3. In the first screen of the dialog (**Baseline protection** ), select
   **Unenforced (monitoring only)** , and then click **Continue**.

4. In the next screen (**Replay protection** ), select **Disabled** , and then
   click **Continue**.

5. In the final screen, click **Continue** to unenforce App Check.

   When App Check isn't enforced for Firebase AI Logic, the
   Gemini API is vulnerable to abuse.
6. **Make sure that you
   [enforce App Check again](https://firebase.google.com/docs/ai-logic/app-check#enforce-app-check)**
   --- especially before you commit your app to a publicly available source code
   control system, share your app, or make your app publicly available.

<br />

<br />