|---|---|
| **Select platform:** | [iOS+](https://firebase.google.com/docs/app-check/ios/recaptcha-enterprise-provider.md.txt) [Android](https://firebase.google.com/docs/app-check/android/recaptcha-enterprise-provider.md.txt) [Web](https://firebase.google.com/docs/app-check/web/recaptcha-enterprise-provider.md.txt) [Flutter](https://firebase.google.com/docs/app-check/flutter/recaptcha-enterprise-provider.md.txt) |

<br />

> [!WARNING]
> **Preview:** Using the reCAPTCHA Enterprise provider in Flutter apps is a feature that's in Preview, which means that it isn't subject to any SLA or deprecation policy and could change in backwards-incompatible ways.

This page shows you how to set up App Check in a Flutter app,
using the reCAPTCHA Enterprise provider. App Check helps to ensure
that only your app can access your project's backend resources.
To learn more, review our [overview of App Check](https://firebase.google.com/docs/app-check.md.txt).

App Check requires the use of *score-based* reCAPTCHA keys, which
makes it invisible to users. This means that the reCAPTCHA Enterprise
provider won't require users to solve a challenge at any time.

If your use case requires reCAPTCHA Enterprise features not implemented
by App Check, or if you want to use App Check with your own custom
provider, see [Implement a custom App Check provider](https://firebase.google.com/docs/app-check/flutter/custom-provider).

> [!NOTE]
> **Note:** In some Google Cloud docs and in some pages of the Google Cloud console, you'll see a product called ***Google Cloud Fraud Defense*** . reCAPTCHA Enterprise is one feature within Google Cloud Fraud Defense.

> [!CAUTION]
> **Caution:** When you use reCAPTCHA Enterprise with a mobile app, the Firebase App Check SDK adds a dependency on the *reCAPTCHA Mobile SDK* . Be aware that the reCAPTCHA Mobile SDK has a deprecation schedule that may be more frequent than the [Firebase deprecation schedule](https://firebase.google.com/policies/changes-to-firebase/overview.md.txt). This means that the App Check SDK for reCAPTCHA Enterprise may have more frequent breaking changes than other Firebase libraries. Learn more about the [deprecation and shutdown policy for the reCAPTCHA Mobile SDK](https://cloud.google.com/recaptcha/docs/deprecation-policy-mobile).

## 1. Set up your Firebase project

1. If you haven't already,
   [install and initialize Firebase in your Flutter project](https://firebase.google.com/docs/flutter/setup.md.txt).

2. In the Google Cloud console, go to the
   [**Fraud Defense** page](https://console.cloud.google.com/security/recaptcha),
   and do the following for the reCAPTCHA Enterprise provider:

   1. Make sure that you're in the correct project (see the project picker at
      the top of the screen).

   2. If prompted, enable the reCAPTCHA Enterprise API.

   3. Create a key based on your target platform:

      ### iOS+

      Create an **iOS** -type key, and specify your app's
      bundle ID (for example, `com.example.my_app`).
      - Make sure that you enter the same bundle ID that you provided
        when you created your Firebase Apple App in your Firebase
        project. The bundle ID value is case-sensitive.

      - For App Check, each bundle ID can only correspond to a
        single reCAPTCHA key.

      ### Android

      Create an **Android** -type key, and specify your app's
      package name (for example, `com.example.my_app`).
      - Make sure that you enter the same package name that you provided
        when you created your Firebase Android App in your Firebase
        project. The package name value is case-sensitive.

      - For App Check, each package name can only correspond to a
        single reCAPTCHA key.

      ### Web

      Create a **Web**-type key, and specify each of the domains
      for your web apps.
      - App Check does ***not*** support web apps that serve on more
        than 250 domains.

      - Never add `localhost` as a domain to a reCAPTCHA key that
        is deployed to (or is going to be deployed to) production.

      - Leave the "Use checkbox challenge" option **unselected**.

      For detailed instructions, see
      [Create score-based reCAPTCHA keys](https://firebase.google.com/docs/app-check/recaptcha-keys.md.txt).
   4. Take note of each key. You'll need to add them into the registration
      flow in the Firebase console.

3. In the Firebase console, navigate to **Security** \>
   [**App Check**](https://console.firebase.google.com/project/_/appcheck/?useAutoProject=true).

4. In the **Apps** tab, register each of your target platform apps to use
   App Check with the reCAPTCHA Enterprise provider.
   You'll need to provide the key you got in the Google Cloud console.

   > [!IMPORTANT]
   > **Important:** Make sure to register all of your project's apps with an attestation provider (like reCAPTCHA Enterprise). **Once you
   > [enable *enforcement*](https://firebase.google.com/docs/app-check/flutter/recaptcha-enterprise-provider.md.txt#enforce) for a service, only registered apps will
   > be able to access the service.**

5. <br />

   <br />

   **Optional**: Set the token time to live (TTL).

   In the app registration settings, set a custom time to live (TTL) for
   App Check tokens issued by the provider. You can set the TTL to any
   value between 30 minutes and 7 days. When changing this value, be aware of
   the following tradeoffs:
   - Security: Shorter TTLs provide stronger security, because it reduces the window in which a leaked or intercepted token can be abused by an attacker.
   - Performance: Shorter TTLs mean your app will perform attestation more frequently. Because the app attestation process adds latency to network requests every time it's performed, a short TTL can impact the performance of your app.
   - Quota and cost: Shorter TTLs and frequent re-attestation deplete your quota faster, and for paid services, potentially cost more. See [Quotas \& limits](https://firebase.google.com/docs/app-check.md.txt#quotas_limits).

   The default TTL of
   **1 hour**
   is reasonable for most apps. Note that the App Check library refreshes
   tokens at approximately half the TTL duration.

   <br />

   <br />

6. **Optional** : [Configure advanced settings.](https://firebase.google.com/docs/app-check/flutter/recaptcha-enterprise-provider.md.txt#advanced-settings)

7. Click **Save**.

### *(Optional)* Configure advanced settings

When a user opens your app, reCAPTCHA Enterprise evaluates the level of
risk the user interaction under the key poses, and returns a score between
0.0 and 1.0, in increments of 0.1.

- A score of 0.0 indicates that the interaction poses high risk and might be fraudulent.
- A score of 1.0 indicates that the interaction poses low risk and is very likely legitimate.

App Check lets you configure an **app risk threshold** so you can adjust
your tolerance for this risk.

For most use cases, the default threshold value of **0.5** is recommended. If
your use case requires adjustment, you can configure this value for each of your
apps in the Firebase console (go to **Security** \>
[**App Check**](https://console.firebase.google.com/project/_/appcheck/?useAutoProject=true)).
Make sure to expand and review some
[important considerations about configuring the app risk threshold](https://firebase.google.com/docs/app-check/flutter/recaptcha-enterprise-provider.md.txt#advanced-settings-details)
below.

<br />

#### View important considerations about app risk threshold

<br />

App Check uses your configured app risk threshold as the minimum
reCAPTCHA Enterprise score required for a user interaction to be deemed
legitimate. All reCAPTCHA Enterprise scores strictly less than your
configured threshold will be rejected. When adjusting your app risk threshold,
be aware of the following:

- If your Firebase project is on the no-cost Spark pricing plan, then out of the
  11 possible reCAPTCHA Enterprise score levels, only the following
  four score levels are available: 0.1, 0.3, 0.7, and 0.9.

  During this time, App Check will correspondingly only allow app risk
  threshold values of 0.1, 0.3, 0.5, 0.7, and 0.9. An app risk threshold value
  of 0.5 is still recommended for most use cases.
  - To enable all 11 reCAPTCHA Enterprise score levels, link a
    Cloud Billing account to your project (which means you upgrade your
    Firebase project to the [pay-as-you-go Blaze pricing plan](https://firebase.google.com/pricing.md.txt)).
    Once you've upgraded your project, App Check will let you configure
    any app risk threshold values between 0.0 and 1.0, in increments of 0.1.

    > [!NOTE]
    > **Note:** After a Cloud Billing account is linked to your project, an automatic security review is triggered for your project. For more information, see the [reCAPTCHA Enterprise documentation](https://docs.cloud.google.com/recaptcha/docs/interpret-assessment-mobile).

- To monitor the distribution of high and low reCAPTCHA Enterprise
  scores for your app, go to the
  [**reCAPTCHA Enterprise** page](https://console.cloud.google.com/security/recaptcha)
  in the Google Cloud console, and select the key used by your app.

- Set your app risk threshold appropriately for your tolerance:

  - If you have **high** app risk tolerance,
    **move the slider to the right** to *decrease* the app risk threshold.

    - A value of 0.0 is ***not*** recommended, as this setting disables abuse protection.
  - If you have **low** app risk tolerance,
    **move the slider to the left** to *increase* the app risk threshold.

    - A value of 1.0 is ***not*** recommended, as this setting can also potentially deny access for legitimate users who don't meet this high trust threshold.

    > [!WARNING]
    > **Warning:** To avoid disrupting your legitimate users, gradually increase the app risk threshold when App Check is enforced. Always [monitor App Check request metrics](https://firebase.google.com/docs/app-check/monitor-metrics.md.txt) to verify that traffic has not been disrupted.

For additional details, review the
reCAPTCHA Enterprise documentation for [mobile apps](https://docs.cloud.google.com/recaptcha/docs/create-assessment-mobile) and [web apps](https://cloud.google.com/recaptcha/docs/interpret-assessment-website).


<br />

<br />

## 2. Add the App Check plugin to your app

To use the reCAPTCHA Enterprise provider, you must add the
corresponding App Check plugin.

1. From the root of your Flutter project, run the following command to
   install the plugin:

   ```bash
   flutter pub add firebase_app_check
   ```
2. Once complete, rebuild your Flutter project:

   ```bash
   flutter run
   ```

## 3. Initialize App Check

In your app, you need to initialize App Check before you use any other
Firebase services.

```dart
import 'package:firebase_core/firebase_core.dart';
import 'package:firebase_app_check/firebase_app_check.dart';
import 'firebase_options.dart';

Future<void> main() async {
  WidgetsFlutterBinding.ensureInitialized();
  await Firebase.initializeApp(options: DefaultFirebaseOptions.currentPlatform);
  await FirebaseAppCheck.instance.activate(
    providerWeb: ReCaptchaEnterpriseProvider(WEB_SITE_KEY),
    providerAndroid: const AndroidReCaptchaProvider(ANDROID_SITE_KEY),
    providerApple: const AppleReCaptchaProvider(IOS_SITE_KEY),
  );
  runApp(App());
}
```

## 4. Monitor metrics and enable enforcement

After you've set up App Check in your app, start distributing the updated
app to your users.

The updated client app will begin sending App Check tokens along with every
request it makes to Firebase. However, **App Check won't block requests with
invalid tokens until [App Check is enforced](https://firebase.google.com/docs/app-check/flutter/recaptcha-enterprise-provider.md.txt#enforce)**.

### Monitor metrics

***Before you enable enforcement***, make sure that doing so won't disrupt your
existing legitimate users. However, if you're seeing suspicious use of your app
resources, you might want to enable enforcement sooner.

To help make this decision, you can review App Check metrics for the
services you use:

- [Monitor App Check request metrics](https://firebase.google.com/docs/app-check/monitor-metrics.md.txt) for Firebase AI Logic, SQL Connect, Realtime Database, Cloud Firestore, Cloud Storage, Authentication, Google Identity for iOS, Maps JavaScript API, and Places API (New).
- [Monitor App Check request metrics for Cloud Functions](https://firebase.google.com/docs/app-check/monitor-functions-metrics.md.txt).

### Enable App Check enforcement

When you understand how App Check will affect your users and you're ready
to proceed, you can enable App Check enforcement:

- [Enable App Check enforcement](https://firebase.google.com/docs/app-check/enable-enforcement.md.txt) for Firebase AI Logic, SQL Connect, Realtime Database, Cloud Firestore, Cloud Storage, Authentication, Google Identity for iOS, Maps JavaScript API, and Places API (New).
- [Enable App Check enforcement for Cloud Functions](https://firebase.google.com/docs/app-check/cloud-functions.md.txt).

## Use App Check in debug environments

App Check classifies some environments as invalid, such as requests from
an emulator / simulator or localhost

during development or from a continuous integration (CI) environment.

To run your app in these types of environments after App Check is enforced,
you need to create a debug build of your app that uses the
App Check *debug provider* instead of a production attestation provider.

<br />

For more details, see
[Use App Check with the debug provider in Flutter apps](https://firebase.google.com/docs/app-check/flutter/debug-provider.md.txt).

## Pricing

App Check creates an assessment on your behalf to validate the user's
response token each time your app refreshes its App Check token. Your
Firebase project will be charged for each assessment created above the no-cost
quota. For details, see
[reCAPTCHA pricing](https://cloud.google.com/security/products/recaptcha#pricing).

By default, your app will refresh this token twice every **1 hour** . To
control how frequently your app refreshes App Check tokens (and thus how
frequently new assessments are created), you can
[configure the token TTL](https://firebase.google.com/docs/app-check/flutter/recaptcha-enterprise-provider.md.txt#set-ttl).