Get started using App Check with a custom provider on Android

This page shows you how to enable App Check in an Android app, using your custom App Check provider. When you enable App Check, you help ensure that only your app can access your project's Firebase resources.

If you want to use App Check with the default Play Integrity provider, see Enable App Check with Play Integrity on Android.

Before you begin

• Add Firebase to your Android project if you haven’t already done so.

• Implement your custom App Check provider's server-side logic.

1. Add the App Check library to your app

In your module (app-level) Gradle file (usually app/build.gradle), declare the dependency for the App Check Android library:

dependencies {
    implementation 'com.google.firebase:firebase-appcheck:17.0.1'
}

dependencies {
    implementation 'com.google.firebase:firebase-appcheck:17.0.1'
}

2. Implement the App Check interfaces

First, you need to create classes that implement the AppCheckProvider and AppCheckProviderFactory interfaces.

Your AppCheckProvider class must have a getToken() method, which collects whatever information your custom App Check provider requires as proof of authenticity, and sends it to your token acquisition service in exchange for an App Check token. The App Check SDK handles token caching, so always get a new token in your implementation of getToken().

class YourCustomAppCheckToken(
    private val token: String,
    private val expiration: Long
) : AppCheckToken() {
    override fun getToken(): String {
        return token
    }

    override fun getExpireTimeMillis(): Long {
        return expiration
    }
}

class YourCustomAppCheckProvider : AppCheckProvider {
    val token: Task<AppCheckToken>
        get() {
            // Logic to exchange proof of authenticity for an App Check token.
            // ...

            // Refresh the token early to handle clock skew.
            val expMillis: Long = expirationFromServer * 1000 - 60000

            // Create AppCheckToken object.
            val appCheckToken: AppCheckToken =
                    YourCustomAppCheckToken(tokenFromServer, expMillis)

            return appCheckToken!
        }
}

public class YourCustomAppCheckToken extends AppCheckToken {
    private String token;
    private long expiration;

    YourCustomAppCheckToken(String token, long expiration) {
        this.token = token;
        this.expiration = expiration;
    }

    @NonNull
    @Override
    public String getToken() {
        return token;
    }

    @Override
    public long getExpireTimeMillis() {
        return expiration;
    }
}

public class YourCustomAppCheckProvider implements AppCheckProvider {
    @Override
    public Task<AppCheckToken> getToken() {
        // Logic to exchange proof of authenticity for an App Check token and
        //   expiration time.
        // ...

        // Refresh the token early to handle clock skew.
        long expMillis = expirationFromServer * 1000 - 60000;

        // Create AppCheckToken object.
        AppCheckToken appCheckToken =
                YourCustomAppCheckToken(tokenFromServer, expMillis);

        return appCheckToken;
    }
}

Also, implement a AppCheckProviderFactory class that creates instances of your AppCheckProvider implementation:

class YourCustomAppCheckProviderFactory : AppCheckProviderFactory {
    fun create(firebaseApp: FirebaseApp): AppCheckProvider {
        // Create and return an AppCheckProvider object.
        return YourCustomAppCheckProvider(firebaseApp)
    }
}

public class YourCustomAppCheckProviderFactory implements AppCheckProviderFactory {
  @Override
  public AppCheckProvider create(FirebaseApp firebaseApp) {
    // Create and return an AppCheckProvider object.
    return new YourCustomAppCheckProvider(firebaseApp);
  }
}

3. Initialize App Check

Add the following initialization code to your app so that it runs before you use any other Firebase SDKs:

FirebaseApp.initializeApp(/*context=*/ this)
val firebaseAppCheck = FirebaseAppCheck.getInstance()
firebaseAppCheck.installAppCheckProviderFactory(
    YourCustomAppCheckProviderFactory.getInstance())

FirebaseApp.initializeApp(/*context=*/ this);
FirebaseAppCheck firebaseAppCheck = FirebaseAppCheck.getInstance();
firebaseAppCheck.installAppCheckProviderFactory(
    YourCustomAppCheckProviderFactory.getInstance());

Next steps

Once the App Check library is installed in your app, start distributing the updated app to your users.

The updated client app will begin sending App Check tokens along with every request it makes to Firebase, but Firebase products will not require the tokens to be valid until you enable enforcement in the App Check section of the Firebase console.

Monitor metrics and enable enforcement

Before you enable enforcement, however, you should make sure that doing so won't disrupt your existing legitimate users. On the other hand, if you're seeing suspicious use of your app resources, you might want to enable enforcement sooner.

To help make this decision, you can look at App Check metrics for the services you use:

• Monitor App Check request metrics for Realtime Database, Cloud Firestore, Cloud Storage, and Authentication (beta).
• Monitor App Check request metrics for Cloud Functions.

Enable App Check enforcement

When you understand how App Check will affect your users and you're ready to proceed, you can enable App Check enforcement:

• Enable App Check enforcement for Realtime Database, Cloud Firestore, Cloud Storage, and Authentication (beta).
• Enable App Check enforcement for Cloud Functions.

Use App Check in debug environments

If, after you have registered your app for App Check, you want to run your app in an environment that App Check would normally not classify as valid, such as an emulator during development, or from a continuous integration (CI) environment, you can create a debug build of your app that uses the App Check debug provider instead of a real attestation provider.

See Use App Check with the debug provider on Android.