Stay organized with collections Save and categorize content based on your preferences.
Use App Check to secure your API keyFirebase App Check provides protection for calls from your app to Google Maps Platform by blocking traffic that comes from sources other than legitimate apps. It does this by checking for a token from an attestation provider like reCAPTCHA Enterprise. Integrating your apps with App Check helps to protect against malicious requests, so you're not charged for unauthorized API calls.
Is App Check right for me?App Check is recommended in most cases, however App Check is not needed or is not supported in the following cases:
At a high level, these are the steps you'll follow to integrate your app with App Check:
Once you've integrated with App Check, you'll be able to see backend traffic metrics on the Firebase console. These metrics provide breakdown of requests by whether they are accompanied by a valid App Check token. See the Firebase App Check documentation for more information.
When you're sure that most requests are from legitimate sources and that users have updated to the latest version of your app that includes your implementation of App Check, you can turn on enforcement. Once enforcement is on, App Check will reject all traffic without a valid App Check token.
Note: App check enforcement is not turned on by default. Considerations when planning an App Check integrationHere are some things to consider as you plan your integration:
The other attestation provider we recommend, reCAPTCHA v3 has a quota, after which traffic won't be evaluated.
You can choose to use a custom attestation provider, though this is an advanced use case. See the App Check documentation for more information.
Users of your app will experience some latency on startup. However, afterwards, any periodic re-attestation will occur in the background and users should no longer experience any latency. The exact amount of latency at startup depends on the attestation provider you choose.
The amount of time that the App Check token is valid (the time to live, or TTL) determines the frequency of re-attestations. This duration can be configured in the Firebase console. Re-attestation occurs when approximately halkf of the TTL has elapsed. For more information, see the Firebase docs for your attestation provider.
Follow the instructions in the Firebase developer documentation to add Firebase to your app.
Step 2: Add the App Check library and initialize App CheckFirebase provides instructions for each default attestation provider. These instructions show you how to set up a Firebase project and add the App Check library to your app. Follow the code samples provided to initialize App Check.
Instructions for reCAPTCHA v3.
You must register your site for reCAPTCHA v3 and get your reCAPTCHA v3 site key and secret key using the reCAPTCHA site registration tool before you enable the API on the Cloud Console. See the reCAPTCHA v3 documentation for more information and instructions.Load the core and Maps libraries as shown in the following snippet. For more information and instructions, see the Maps JavaScript API documentation.
async function init() {
const {Settings} = await google.maps.importLibrary('core');
const {Map} = await google.maps.importLibrary('maps');
} import {initializeApp} from 'firebase/app';
import {
getToken,
initializeAppCheck,
ReCaptchaEnterpriseProvider,
} from 'firebase/app-check';
async function init() {
const {Settings} = await google.maps.importLibrary('core');
const {Map} = await google.maps.importLibrary('maps');
const app = initializeApp({
// Your firebase configuration object
});
// Pass your reCAPTCHA Enterprise site key to initializeAppCheck().
const appCheck = initializeAppCheck(app, {
provider: new ReCaptchaEnterpriseProvider(
'abcdefghijklmnopqrstuvwxy-1234567890abcd',
),
// Optional argument. If true, the SDK automatically refreshes App Check
// tokens as needed.
isTokenAutoRefreshEnabled: true,
});
Settings.getInstance().fetchAppCheckToken = () =>
getToken(appCheck, /* forceRefresh = */ false);
// Load a map
map = new Map(document.getElementById("map"), {
center: { lat: 37.4161493, lng: -122.0812166 },
zoom: 8,
});
}
If you'd like to develop and test your app locally, or run it in a continuous integration (CI) environment, you can create a debug build of your app that uses a debug secret to obtain valid App Check tokens. This lets you avoid using real attestation providers in your debug build.
To test your app locally:
To run your app in a CI environment:
Before you begin enforcement, you'll want to make sure that you won't disrupt legitimate users of your app. To do this, visit the App Check metrics screen to see what percentage of your app's traffic is verified, outdated, or illegitimate. Once you see that the majority of your traffic is verified, you can enable enforcement.
See the Firebase App Check documentation for more information and instructions.
Before you enforce App Check, make sure any Web Service calls in your Cloud project use OAuth.Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-07-09 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-07-09 UTC."],[[["Firebase App Check secures your Google Maps Platform API key by verifying app requests and blocking unauthorized traffic."],["App Check integrates with attestation providers like reCAPTCHA Enterprise to validate requests, protecting against malicious activity and unnecessary charges."],["Implementation involves adding Firebase and App Check to your app, initializing with a token provider, and enabling enforcement after monitoring request metrics."],["Consider potential costs associated with reCAPTCHA Enterprise and temporary latency for users during initial attestation."],["Before enforcing App Check, ensure the majority of your app traffic is verified to avoid disrupting legitimate users."]]],[]]
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4