Skip to content
Get a quote

Firebase App CheckFirebase App Check is blocking my app’s requests

You enforced App Check on Firestore, Storage or another Firebase product, and now some requests fail: on localhost, in tests, or for users on an older version of the app. Here’s why, in Firebase’s own words, and how to fix each case, or hand it over at a fixed price.

Short answer

Once App Check is enforced, every request without a valid App Check token is rejected. Localhost and CI need a debug token registered in the console, older app versions without the App Check SDK fail until users update, and enforcement can take up to 15 minutes to apply. Check the App Check metrics before enforcing, and keep it on.

Who gets blocked, and the fix

  1. 01

    Localhost and CI

    “After App Check is enforced for a backend service, your app's features that depend on that backend service won't run from localhost or from a continuous integration (CI) environment” Firebase, Use the debug provider (web)

    Development machines and test runners can’t pass App Check’s device checks. Use the debug provider in development builds and register the debug token in the Firebase console. Keep debug tokens out of your repository and your production build.

  2. 02

    No token is being sent

    If every request fails, check App Check is set up in your app before other Firebase calls, with a provider for this app, such as reCAPTCHA on the web. Without a token, every call counts as unverified.

  3. 03

    Older versions of your app

    “Enforcing App Check on a released app will break prior app versions that are not integrated with the App Check SDK.” Firebase, Monitor App Check request metrics

    Versions released before you added the App Check SDK send no token, so enforcement blocks them. Check the metrics: if many requests are outdated clients, ship the update, wait for users to move to it, then enforce.

  4. 04

    Every unverified request, on purpose

    “Once you enable enforcement for a product, all unverified requests to that product will be rejected.” Firebase, Enable App Check enforcement

    That’s what enforcement is for: requests with no valid token are rejected, including calls that reuse your API key outside your app. In the metrics, unknown origin requests have no token and don’t look like they come from the Firebase SDK. Firebase says they might be using stolen API keys or be forged, so they’re often traffic you want blocked.

Checked against the vendor’s docs on : Firebase docs: Enable App Check enforcement; Firebase docs: Monitor App Check request metrics; Firebase docs: App Check debug provider (web).

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Related: Firestore missing or insufficient permissions · Firebase Cloud Functions CORS error · SafetyNet is gone: Play Integrity and App Check

Questions

More on this error

I just enforced it and nothing changed. Why?

Firebase says enforcement can take up to 15 minutes to take effect after you turn it on.

Should I turn enforcement off to fix it?

Only as a short stopgap while you fix the cause. Enforcement is what stops requests that don’t come from your app, so fix debug tokens and outdated clients and turn it back on.

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.

A different error?

Describe it and get a written quote

Send the error and what you were doing. You get a written scope, a fixed price and a timeline; we reply by email, usually within one business day.

Describe your problem All fixes