Firebase's console setup flow for AI Logic now turns on App Check automatically, closing off a common way developers shipped apps with an open Gemini API proxy.
Firebase’s guided setup for AI Logic now turns on App Check by default. Starting early July 2026, walking through the console’s “Get started” flow for AI Logic automatically enforces App Check on the project, according to Firebase’s AI Logic documentation. Previously, App Check was a step developers had to remember and add themselves.
Why it matters #
AI Logic routes Gemini API calls from mobile and web clients through a Firebase-hosted proxy, so an app’s API key never sits in client code. But without App Check in front of that proxy, anyone who extracts the app’s Firebase config can replay it from a script and run up the project’s Gemini bill. App Check verifies that requests come from the app’s own registered instances (Play Integrity on Android, App Attest on iOS, reCAPTCHA on web) before they reach the proxy.
The gap this closes is a familiar one: App Check has always been available for AI Logic, but making a project’s Gemini API calls actually get rejected without it required a developer to add the App Check SDK and flip it on as a separate step, one it was easy to skip when the goal was to get a Gemini call working quickly. New projects that complete the guided setup no longer get that choice.
Where this fits #
This is not App Check’s first pass at AI Logic specifically. At Cloud Next 2026, Google said it would add App Check replay protection for AI Logic: single-use tokens that stop a captured token from being reused, with rollout starting in May 2026 (Firebase, April 2026). The zero-config initialization shortcut for App Check’s reCAPTCHA Enterprise provider landed separately, in JavaScript SDK 12.15.0 in June (Firerun, June 2026). Auto-enforcement during setup is the next step in the same push: rather than making App Check easier to add, the console setup flow now adds it for you.
What changes for existing apps #
The enforcement applies to the guided setup workflow, so it’s aimed at projects being newly wired up to AI Logic, not a retroactive flip for every existing app. Enforced App Check will reject unverified requests, so local development needs the App Check debug provider. It bypasses device attestation so a development build can still call the Gemini API without weakening the production configuration. Google’s guidance is explicit that a debug token should never ship in a production build or land in a public repository, since a leaked debug token defeats the protection it’s meant to test.
What to do #
If your AI Logic integration predates this change, don’t assume enforcement is already on. Check the project’s App Check settings in the console rather than relying on setup-flow defaults you may have completed months ago. Projects still calling the Gemini API through AI Logic without App Check are exposed to exactly the abuse case this update targets: a copied config being replayed outside the real app. Turning on App Check now, and reserving the debug provider strictly for local builds, closes that gap regardless of when the project was created.