{"id":"firebase-app-check","name":"firebase-app-check","summary":"アプリ認証の実装、App Checkプロバイダーの設定、デバッグトークンの設定、バックエンドの強制有効化、トークン更新管理の際に利用します。","body":"# Firebase App Check Skill\n\nThis skill defines how to correctly implement Firebase App Check in Flutter applications, covering provider selection, debug configuration, enforcement rollout, and security hardening.\n\n## When to Use\n\nUse this skill when:\n\n* Setting up and activating Firebase App Check in a Flutter project.\n* Selecting the right attestation provider for each platform.\n* Configuring debug providers for development, testing, and CI.\n* Enabling enforcement and monitoring App Check metrics.\n* Implementing token refresh handling and custom TTL configuration.\n\n---\n\n## 1. Setup and Configuration\n\n```\nflutter pub add firebase_app_check\n```\n\n```dart\nimport 'package:firebase_app_check/firebase_app_check.dart';\n```\n\nInitialize App Check **after** `Firebase.initializeApp()` and **before** using any Firebase services:\n\n```dart\nawait Firebase.initializeApp();\nawait FirebaseAppCheck.instance.activate(\n  webProvider: ReCaptchaV3Provider('recaptcha-v3-site-key'),\n  androidProvider: AndroidProvider.playIntegrity,\n  appleProvider: AppleProvider.deviceCheck,\n);\n```\n\n### Setup Checklist\n\n1. Register apps in the Firebase console under **Project Settings > App Check**.\n2. For web, obtain a reCAPTCHA v3 site key from the Firebase console.\n3. Confirm activation completes before any Firestore, Storage, or RTDB calls.\n4. Consider setting a custom **TTL** — shorter TTLs are more secure but consume quota faster.\n\n---\n\n## 2. Provider Selection\n\n**Android:**\n| Provider | Use case |\n|---|---|\n| `AndroidProvider.playIntegrity` | Production (default) |\n| `AndroidProvider.debug` | Development / CI only |\n\n**Apple (iOS / macOS):**\n| Provider | Use case |\n|---|---|\n| `AppleProvider.deviceCheck` | Production default (iOS 11+, macOS 10.15+) |\n| `AppleProvider.appAttest` | Enhanced security (iOS 14+, macOS 14+) |\n| `AppleProvider.appAttestWithDeviceCheckFallback` | App Attest with Device Check fallback |\n| `AppleProvider.debug` | Development / CI only |\n\n**Web:**\n| Provider | Use case |\n|---|---|\n| `ReCaptchaV3Provider` | Standard reCAPTCHA v3 |\n| `ReCaptchaEnterpriseProvider` | Enhanced with additional features |\n\n> **Android note:** For certain Android devices, enable \"Meets basic device integrity\" in the Google Play console to ensure proper App Check functionality.\n\n---\n\n## 3. Development and Testing\n\nUse debug providers during development to run in emulators or CI environments:\n\n```dart\nawait Firebase.initializeApp();\nawait FirebaseAppCheck.instance.activate(\n  androidProvider: AndroidProvider.debug,\n  appleProvider: AppleProvider.debug,\n);\n```\n\n### Platform-Specific Debug Setup\n\n**iOS:** Enable debug logging by adding `-FIRDebugEnabled` to Arguments Passed on Launch in Xcode. The debug token appears in the console output.\n\n**Android:** The debug token prints to logcat on first run. Filter by `DebugAppCheckProvider`.\n\n**Web:** Set `self.FIREBASE_APPCHECK_DEBUG_TOKEN = true;` in `web/index.html` before Firebase scripts load.\n\n### Register Debug Tokens\n\n1. Copy the debug token from the device/emulator console output.\n2. In the Firebase console, navigate to **App Check > Apps > Manage debug tokens**.\n3. Add the token. It is immediately active for that app.\n\n### Token Listener for Custom Backends\n\n```dart\nFirebaseAppCheck.instance.onTokenChange.listen((token) {\n  // Attach token to custom backend requests\n  // e.g., set as Authorization header\n});\n```\n\n- **Never** use debug providers or share debug tokens in production builds.\n- Keep debug tokens private — do not commit them to public repositories.\n- Revoke compromised debug tokens immediately from the Firebase console.\n\n---\n\n## 4. Enforcement Rollout\n\nFollow this sequence to avoid disrupting legitimate users:\n\n1. **Deploy** App Check activation code to all app versions.\n2. **Monitor** App Check metrics in the Firebase console — wait until most traffic shows valid tokens.\n3. **Enable enforcement** gradually, starting with non-critical Firebase services (e.g., Cloud Storage before Firestore).\n4. **Verify** that unverified request percentage drops to near zero before enforcing on critical services.\n\n- Once enforcement is enabled, only apps with valid App Check tokens can access protected Firebase resources.\n- Use App Check **in combination with** Firebase Security Rules for defense in depth.\n- Implement proper error handling for App Check verification failures — surface a user-friendly message rather than a raw error.\n\n---\n\n## 5. Security Best Practices\n\n- Never disable App Check in production builds once enabled.\n- Implement a fallback mechanism for App Check verification failures (e.g., retry with exponential backoff).\n- Regularly review App Check metrics to identify potential abuse patterns.\n- App Check tokens are **automatically refreshed** at approximately half the TTL duration.\n- For high-security applications, use the shortest practical TTL.\n- Implement server-side verification for critical operations using the Firebase Admin SDK:\n\n```\n// Node.js Admin SDK example for verifying App Check tokens\nconst appCheckToken = req.header('X-Firebase-AppCheck');\nconst appCheckClaims = await getAppCheck().verifyToken(appCheckToken);\n```\n\n---\n\n## References\n\n- [Firebase App Check Flutter documentation](https://firebase.google.com/docs/app-check/flutter/default-providers)\n- [Firebase App Check debug provider](https://firebase.google.com/docs/app-check/flutter/debug-provider)","author":"@evanca","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/evanca/flutter-ai-rules/tree/main/skills/firebase-app-check","license":"MIT","category":"security","lang":"en","tokens":1144,"stars":0,"calls30d":0,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":["firebase.google.com"]}}