How do Firebase App Check tokens work?

Learn how App Check tokens work so you can safely use them with your high value services.
Chapters:
0:00 - Introduction
0:50 - What is App Check?
1:17 - How does App Check Work?
2:05 - How App Check Tokens are validated
4:08 - Replay Protection
4:17 - Conclusion
Resource:
Verifying App Check tokens in other backends → goo.gle/3ZA761s
Subscribe to Firebase → goo.gle/Firebase
#Firebase #App #Check #Security

[@vickoalan]

in my flutter app (android) , I couldn't get Debug Token in terminal ! Please We want more videos that explain App Check well !

[@thinclient5318]

Fix debug tokens. Now that safenet is deprecated 🙄 We have to disable app check when not in any release tracks.

[@alexandernohe9416]

Can you help me understand what is happening with debug tokens? You can still have testers use App Check by releasing to the internal testing track on Google Play. It will be signed with the Google Play Signing key and your app should still work. Does this not work for you? When do you run into your app not being available on a Google Play track?

[@freshtechtips]

Hi, This is really important, the offical documentation doesn't cover how to validate the app check token without the supported sdks, like java or kotlin, I tried to search for the endpoint but I didn't find it and now I did I hope the offical documentation will cover this in the future

[@daviddomkar]

Hi. The documentation covers it. You just need to select "Other" as a example language when on "Verify tokens on the backend" section of the App Check docs.

[@freshtechtips]

​@daviddomkar Thank you for informing me. They did update that the documentation recently I searched about it in the beginning of 2023 and didn't found anything.

[@paulogimenez749]

Thank you very much. Excellent explanation. Very objective. Congratulations.

[@user-gu5ts5nx8r]

Great security check.

[@BhojpuriyaaDhamaka]

Setup is completed for App check and Captcha V3. I received token as well. As i am using Realtime Database of firebase does it require to pass token in header for this too? As I am getting error as Missing App check Token.

[@programmingintrouble]

Does Play Integrity for Android only work once the app is published on the Google Play Store?

[@alexandernohe9416]

Yes. You could also implement a custom provider and setup Play Integrity that way to determine your own integrity verdict scores to release an App Check Token.

[@venir_dev]

that's cool and all, but I wonder why all the jwt I receive from app check are marked as "invalid signature" - I'm just trying the feature in debug mode

[@rajmc2107]

My app is already in app store with out App check. Now i enable App Check for my new version which i will be releasing soon to prod. During this time will existing app which is already in prod will break since App Check is enabled in Firebase Console of that app id?

[@BhojpuriyaaDhamaka]

In app check if any API is enforced then It will break for older versions.

[@Novogod]

Really buggy feature. Docs are outdated. Does not work in my apps.