This module requires that the @react-native-firebase/app module is already setup and installed. To install the "app" module, view the Getting Started documentation.

# Install & setup the app module
yarn add @react-native-firebase/app

# Install the app-check module
yarn add @react-native-firebase/app-check

# If you're developing your app using iOS, run this command
cd ios/ && pod install

App Check requires you set the minimum iOS Deployment version in ios/Podfile to 11.0 or greater.

You may have Xcode compiler errors after including the App Check module, specifically referencing linker problems and missing directories.

You may find excluding the i386 architecture via an addition to the ios/Podfile post_install hook like the below works:

    installer.aggregate_targets.each do |aggregate_target|
      aggregate_target.user_project.native_targets.each do |target|
        target.build_configurations.each do |config|
          config.build_settings['ONLY_ACTIVE_ARCH'] = 'NO'
          config.build_settings['EXCLUDED_ARCHS'] = 'i386'
        end
      end
      aggregate_target.user_project.save
    end

Platform notes: Use ReactNativeFirebaseAppCheckProvider for native attestation (Device Check, App Attest, Play Integrity). firebase-js-sdk ReCaptchaEnterpriseProvider and ReCaptchaV3Provider are web only.

App Check works alongside other Firebase services to help protect your backend resources from abuse, such as billing fraud or phishing. With App Check, devices running your app will use an app or device attestation provider that attests to one or both of the following:

• Requests originate from your authentic app
• Requests originate from an authentic, untampered device

This attestation is attached to every request your app makes to your Firebase backend resources.

This App Check module has built-in support for using the following services as attestation providers:

• DeviceCheck on iOS
• App Attest on iOS
• Play Integrity on Android (requires distribution from Play Store to successfully fetch tokens)
• SafetyNet on Android (deprecated)
• Debug providers on both platforms

App Check currently works with the following Firebase products:

• Realtime Database
• Cloud Firestore
• Cloud Storage
• Cloud Functions (callable functions)

The official Firebase App Check documentation has more information, including about the iOS AppAttest provider, and testing/ CI integration, it is worth a read.

Before the App Check package can be used on iOS or Android, the corresponding App must be registered in the firebase console.

For instructions on how to generate required keys and register an app for the desired attestation provider, follow Step 1 in these firebase guides:

• Get started using App Check with DeviceCheck on Apple platforms
• Get started using App Check with App Attest on Apple platforms
• Get started using App Check with Play Integrity on Android
• Get started using App Check with SafetyNet on Android (deprecated)

Additionally, You can reference the iOS private key creation and registrations steps outlined in the Cloud Messaging iOS Setup.

If you're using Expo Managed Workflow, you can load the @react-native-firebase/app-check config plugin to skip the native setup step below. The plugin only registers the native module before FirebaseApp.configure() (Firebase requires this order regardless of which provider you use); you still need to call initializeAppCheck from JavaScript.

You must call initializeAppCheck prior to calling any Firebase backend services for App Check to function. Until initializeAppCheck (or the deprecated activate) configures a provider, App Check is pending: any getToken / getLimitedUseToken call fails immediately with appCheck/provider-not-ready instead of fetching a real token.

The AppCheck pod does not expose a Swift-importable module surface (its C++ codegen headers stay private), so importing it directly in a Swift file does not work. Edit the bridging header at <your project name>/ios/<your project-name>-Bridging-Header.h

You will need to add the line indicated in the example below:

//
// Use this file to import your target's public headers that you would like to expose to Swift.
//

+ #import "RNFBAppCheckModule.h" // <-- new for AppCheck to work

After doing that, follow the instructions below to add AppCheck initialization to your AppDelegate.swift file depending on the react-native version you use.

To do that, edit your ios/ProjectName/AppDelegate.swift and add the following two lines:

At the top of the file, import the FirebaseCore SDK right after import UIKit: And within your existing didFinishLaunchingWithOptions method, add the following to the top of the method:

import UIKit
+ import FirebaseCore  // <-- From App/Core integration, no other Firebase items needed
import React
import React_RCTAppDelegate
import ReactAppDependencyProvider

...

  func application(
    _ application: UIApplication,
    didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]? = nil
  ) -> Bool {
+   RNFBAppCheckModule.sharedInstance()  // <-- new for AppCheck to work
+   FirebaseApp.configure()              // <-- From App/Core integration

To do that, edit your ios/ProjectName/AppDelegate.swift and add the following two lines:

At the top of the file, import the FirebaseCore SDK right after import UIKit: And within your existing didFinishLaunchingWithOptions method, add the following to the top of the method:

import UIKit
+ import FirebaseCore  // <-- From App/Core integration, no other Firebase items needed
import React
import React_RCTAppDelegate
import ReactAppDependencyProvider

@main
class AppDelegate: RCTAppDelegate {
  override func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey : Any]? = nil) -> Bool {
+   RNFBAppCheckModule.sharedInstance()  // <-- new for AppCheck to work
+   FirebaseApp.configure()              // <-- From App/Core integration

Note: Do not add import RNFBAppCheck in Swift. The AppCheck pod is Obj-C only and does not produce a Swift module. Use the bridging header import above instead.

To do that, edit your ios/ProjectName/AppDelegate.mm and add the following two lines:

#import "AppDelegate.h"
#import "RNFBAppCheckModule.h" // ⬅️ ADD THIS LINE
#import <Firebase.h>
...

- (BOOL)application:(UIApplication *)application didFinishLaunchingWithOptions:(NSDictionary *)launchOptions
{
  // Initialize RNFBAppCheckModule, it sets the custom RNFBAppCheckProviderFactory
  // which lets us configure any of the available native platform providers,
  // and reconfigure if needed, dynamically after `[FIRApp configure]` just like the other platforms.

  [RNFBAppCheckModule sharedInstance]; // ⬅️ ADD THIS LINE BEFORE [FIRApp configure]

  [FIRApp configure];

  ...
}

There are several differences between the web, Apple, and Android platform SDKs produced by Firebase, which react-native-firebase smooths over to give you a common, firebase-js-sdk compatible API.

How do we do this? We use the standard firebase-js-sdk v9 API initializeAppCheck, and take advantage of its parameters which allow the use of an AppCheckOptions argument that itself allows a CustomProvider.

It is through the use of a react-native-specific ReactNativeFirebaseAppCheckProvider that we can offer runtime configuration capability at the javascript level, including the ability to switch providers dynamically.

So AppCheck module initialization is done in two steps in react-native-firebase - first you create and configure the custom provider, then you initialize AppCheck using that custom provider.

Starting in v25, the modular App Check helpers and types are exported from @react-native-firebase/app-check at the package root to better match the Firebase JS SDK. For example, import initializeAppCheck, AppCheck, and AppCheckTokenResult directly from @react-native-firebase/app-check when using the modular API.

To configure the react-native-firebase custom provider, first obtain one, then configure it according to the providers you want to use on each platform.

import { ReactNativeFirebaseAppCheckProvider } from '@react-native-firebase/app-check';

const rnfbProvider = new ReactNativeFirebaseAppCheckProvider();
rnfbProvider.configure({
  android: {
    provider: __DEV__ ? 'debug' : 'playIntegrity',
    debugToken: 'some token you have configured for your project firebase web console',
  },
  apple: {
    provider: __DEV__ ? 'debug' : 'appAttestWithDeviceCheckFallback',
    debugToken: 'some token you have configured for your project firebase web console',
  },
  web: {
    provider: 'reCaptchaV3',
    siteKey: 'unknown',
  },
});

Once you have the custom provider configured, install it in app-check using the firebase-js-sdk compatible API, while saving the returned instance for usage:

import { getApp } from '@react-native-firebase/app';
import { initializeAppCheck } from '@react-native-firebase/app-check';

const appCheck = await initializeAppCheck(getApp(), {
  provider: rnfbProvider,
  isTokenAutoRefreshEnabled: true,
});

If you do not need to keep a provider instance around, you can pass the React Native provider configuration inline using providerOptions:

import { getApp } from '@react-native-firebase/app';
import { initializeAppCheck } from '@react-native-firebase/app-check';

const appCheck = await initializeAppCheck(getApp(), {
  provider: {
    providerOptions: {
      android: {
        provider: __DEV__ ? 'debug' : 'playIntegrity',
        debugToken: 'some token you have configured for your project firebase web console',
      },
      apple: {
        provider: __DEV__ ? 'debug' : 'appAttestWithDeviceCheckFallback',
        debugToken: 'some token you have configured for your project firebase web console',
      },
      web: {
        provider: 'reCaptchaV3',
        siteKey: 'unknown',
      },
    },
  },
  isTokenAutoRefreshEnabled: true,
});

After initializing the custom provider, you can verify AppCheck is working by logging a response from the token server:

import { getToken } from '@react-native-firebase/app-check';

try {
  // `appCheckInstance` is the saved return value from initializeAppCheck
  const { token } = await appCheckInstance.getToken(true);

  if (token.length > 0) {
    console.log('AppCheck verification passed');
  }
} catch (error) {
  console.log('AppCheck verification failed');
}

On Android, you can subscribe to App Check token updates with onTokenChanged. On iOS this listener is not implemented yet – subscribing will no-op and log a warning. If you need to react to token changes on iOS, prefer polling getToken on demand or rely on automatic refresh.

import { onTokenChanged, getToken } from '@react-native-firebase/app-check';

// Android: receives updates. iOS: no-op (native API does not exist on the SDK).
const unsubscribe = onTokenChanged(appCheckInstance, async ({ token }) => {
  console.log('App Check token updated:', token);
});

// iOS-friendly approach: request a fresh token when needed
const { token } = await appCheckInstance.getToken(true);

App Check has an "tokenAutoRefreshEnabled" setting. This may cause App Check to attempt a remote App Check token fetch prior to user consent. In certain scenarios, like those that exist in GDPR-compliant apps running for the first time, this may be unwanted.

You may configure this setting in firebase.json such that your desired configuration is in place even before you the react-native javascript bundle begins executing and allows for runtime configuration.

If unset, the "tokenAutoRefreshEnabled" setting will defer to the app's "automatic data collection" setting, which may be set in firebase.json, or if you wish directly in the Info.plist or AndroidManifest.xml according to the Firebase native SDK documentation. Unless otherwise configured, it will default to true implying there will be automatic data collection and app check token refresh attempts.

The official documentation shows how to use getToken to access the current App Check token and then verify it in external services.

If getToken / getLimitedUseToken rejects with appCheck/provider-not-ready, App Check has not been configured yet for that app. Call initializeAppCheck (or the deprecated activate) before requesting tokens or calling any App Check-protected Firebase service.

This error replaces an older iOS behavior where App Check could install the debug provider before initializeAppCheck ran, including in release builds. That could exchange a debug token with Firebase's backend outside of development, showing up as unexplained exchangeDebugToken 403/429 responses in your logs. If you saw those errors before upgrading, look for a code path that requests a token before initializeAppCheck completes and move it after.

The react-native-firebase CustomProvider implementation allows for runtime configuration of the debug provider as well as a debugToken in the ios CustomProvider options. This allows the easy use of a token pre-configured in the Firebase console, allowing for dynamic configuration and testing of AppCheck in CI environments or iOS Simulators.

The react-native-firebase CustomProvider implementation allows for runtime configuration of the debug provider as well as a debugToken in the android CustomProvider options. This allows the easy use of a token pre-configured in the Firebase console, allowing for dynamic configuration and testing of AppCheck in CI environments or Android Emulators.

There are a variety of other ways to obtain and configure debug tokens for AppCheck testing, a few of which follow:

1. Start your application on the android device.

2. Use $adb logcat | grep DebugAppCheckProvider to grab your temporary secret from the android logs. The output should look lit this:

   D DebugAppCheckProvider: Enter this debug secret into the allow list in
   the Firebase Console for your project: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
   

3. In the Project Settings > App Check section of the Firebase console, choose Manage debug tokens from your app's overflow menu. Then, register the debug token you logged in the previous step.

When you want to test using an Android virtual device -or- when you prefer to (re)use a token of your choice -- e.g. when configuring a CI/CD pipeline -- use the following steps:

1. In the Project Settings > App Check section of the Firebase console, choose Manage debug tokens from your app's overflow menu. Then, register a new debug token by clicking the Add debug token button, then Generate token.

2. Pass the token you created in the previous step by supplying a FIREBASE_APP_CHECK_DEBUG_TOKEN environment variable to the process that build your react-native android app. e.g.:

   FIREBASE_APP_CHECK_DEBUG_TOKEN="XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" react-native run-android
   

Please note that once the android app has successfully passed the app-checks controls on the device, it will keep passing them, whether you rebuild without the secret token or not. To completely reset app-check, you must first uninstall, and then re-build / install.

When using expo-dev-client, the process is a little different, especially on an android emulator.

1. In the Project Settings > App Check section of the Firebase console, choose Manage debug tokens from your app's overflow menu. Then, register a new debug token by clicking the Add debug token button, then Generate token.
2. Pass the token you created in the previous step by supplying a FIREBASE_APP_CHECK_DEBUG_TOKEN environment variable in your eas.json development profile:

{
  ...
  "build": {
    "development": {
      "developmentClient": true,
      "distribution": "internal",
      "env": {
        ...
        "FIREBASE_APP_CHECK_DEBUG_TOKEN": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
      }
    },
    ...
  },
  ...
}

3. Rebuild your development client:

   eas build --profile development --platform android