Firebase App Check is a security feature offered by Google Firebase that helps protect your Flutter app from unauthorized access and abuse. It works by verifying that incoming requests to your app's backend resources (like databases, storage, or custom APIs) originate from your legitimate app and not from a malicious source.
Basically it makes sure that the firebase cloud requests that you are receiving are originating from your app. Not from a bad actor that wants to run your cloud bill up.
Here's how to set it up.
Step 1: Make sure that your Flutter apps are connected to firebase.
If you want to know how to do that: I wrote a comprehensive article on connecting your Flutter apps to Firebase.
After we are done connecting this is how our main() should look like:
void main() async {
WidgetsFlutterBinding.ensureInitialized();
await Firebase.initializeApp(options: DefaultFirebaseOptions.currentPlatform);
runApp(const MyApp());
}
Step 2: Add Firebase App Check plugin to your pubspec.yaml
We are going to install firebase_app_check plugin to activate app check later.
\==Note: Run the following command from inside your project directory.==
flutter pub add firebase_app_check
This is my terminal output:
This is my updated pubspec.yaml :
Do note that your version might be different from mine as Firebase tends to update their plugins regularly.
Step 3: Activate App Check on Firebase
Go to your Firebase console and click on all products and select App Check.
After that click on Get started on App Check:
Now you'll see the option to register app check on all the apps that are connected to your firebase.
Step 4: Registering Android
First we are going to start with Android.
When I click on the register button for android I get the following two options:
\==We should choose Play Integrity as SafetyNet has been deprecated.==
When I select Play Integrity it'll ask us for the SHA-256 certificate fingerprint of our android app:
So here's how we generate SHA-256 for our android app:
Go to your project root directory in your terminal and run the following command:
cd android
Now that we are in the android folder we'll have to generate signing report. So we can just run the following command:
./gradlew signingReport
It should take a few minutes but in the end you'll get your SHA-1 and SHA-256.
Here's the output from my terminal when I run the above command:
You'll see a variants like debug, release profile, debugAndroidTest and so on ...
But you can copy the values from any one of them because they are all the same.
Paste SHA-256 into Firebase App Check:
After that you can hit Save. Also if you want can decrease the Token time to live depending on your preferences.
Finally Our Android is registered 🎉
Important: Make sure to register your SHA keys for the app inside project settings.
- Let's go to project settings for our firebase console.
You can see all the apps connected in our Firebase. Let's select our android app:
Click on Add fingerprint and add our SHA-1 key as well from our terminal
So this should be the end result.
- Important: When you release the app on Google Play Store change these keys with the ones you get from Google Play Signing.
Step 5: Registering iOS
Prerequisite: In iOS we have both Device Check and App Attest. We'll be using them both. In order to have that you'd need an Active Apple Developer Account.
App Attest:
- So when we tap on the iOS section in App Check we see the following two options:
- We'll be use App Attest as it offers us more granular control. But App Attest requires your Team ID which you'd get from a paid Apple Developer Account:
You can get your Team ID by going to Your Apple Developer Account. Over When you scroll down you should find your Team ID under Membership Details:
Once you get the Team ID. You can paste it in here and register the app.
After setting it up we need to configure App Attest in Xcode:
Open your app it Xcode and add App Attest in it's capability
To make the App attest work we need to set the App Attest Environment in the ==.entitlements== to production
Device Check:
When we click on the Device check in the Firebase App Check, we can see that we need to enter Auth Key, Key ID and Team ID information.
Now let's generate one by one
As I said to generate an Auth Key, we need an Apple developer account. If you have an account you can get generate auth keys from the Apple Developer keys page.
After clicking "Create a Key", you can enter any Key Name and then enable the Device check option.
Now proceed with clicking on the Continue button and finally click on the Register button.
\==Remember that we can download the key only once. So make sure to store it in a secure place.==
Once downloaded, make sure to add it to your Firebase and click on save. 6.Finally you should be able to see both your apps registered under you app check 🎉🎉:
Step 6: Setup App Check in our Flutter App:
- In
main() go ahead and add the following code:
void main() async {
WidgetsFlutterBinding.ensureInitialized();
await Firebase.initializeApp(options: DefaultFirebaseOptions.currentPlatform);
await FirebaseAppCheck.instance.activate(
appleProvider: kDebugMode
? AppleProvider.debug
: AppleProvider.appAttestWithDeviceCheckFallback,
androidProvider:
kDebugMode ? AndroidProvider.debug : AndroidProvider.playIntegrity);
runApp(const MyApp());
}
And that's it your Firebase App Check is setup and should be working. Now you can be rest assured that every API call that you encounter on your Firebase is going to be from an authorized user using your app.
