Stay organized with collections Save and categorize content based on your preferences.
Use App Check to secure your API keyFirebase App Check provides protection for calls from your app to Google Maps Platform by blocking traffic that comes from sources other than legitimate apps. It does this by checking for a token from an attestation provider like App Attest. Integrating your apps with App Check helps to protect against malicious requests, so you're not charged for unauthorized API calls.
Is App Check right for me?App Check is recommended in most cases, however App Check is not needed or is not supported in the following cases:
At a high level, these are the steps you'll follow to integrate your app with App Check:
Once you've integrated with App Check, you'll be able to see backend traffic metrics on the Firebase console. These metrics provide breakdown of requests by whether they are accompanied by a valid App Check token. See the Firebase App Check documentation for more information.
When you're sure that most requests are from legitimate sources and that users have updated to the latest version of your app that includes your implementation of App Check, you can turn on enforcement. Once enforcement is on, App Check will reject all traffic without a valid App Check token.
Note: App check enforcement is not turned on by default. Considerations when planning an App Check integrationHere are some things to consider as you plan your integration:
The attestation providers we recommend, Device Check or App Attest, are subject to quotas and limitations set by Apple.
You can choose to use a custom attestation provider, though this is an advanced use case. See the Firebase App Check documentation for more information.
Users of your app will experience some latency on startup. However, afterwards, any periodic re-attestation will occur in the background and users should no longer experience any latency. The exact amount of latency at startup depends on the attestation provider you choose.
The amount of time that the App Check token is valid (the time to live, or TTL) determines the frequency of re-attestations. This duration can be configured in the Firebase console. Re-attestation occurs when approximately halkf of the TTL has elapsed. For more information, see the Firebase docs for your attestation provider.
Follow the instructions in the Firebase developer documentation to add Firebase to your app.
When you register your app, you'll get a configuration file, GoogleService-Info.plist
. Add this file, unmodified, to the root level of your app.
AppDelegate
file, add the following modules: Places Swift SDK for iOS
import FirebaseCore import FirebaseAppCheck import GooglePlacesSwiftSwift
import FirebaseCore import FirebaseAppCheck import GooglePlacesObjective-C
@import FirebaseCore; @import FirebaseAppCheck; @import GooglePlaces;Step 2: Add the App Check library and initialize App Check
Firebase provides instructions for each default attestation provider. These instructions show you how to set up a Firebase project and add the App Check library to your app. Follow the code samples provided to initialize App Check.
Follow the Firebase App Check instructions to create an implementation of AppCheckProviderFactory
and add it to your AppDelegate
file.
let providerFactory = YourAppCheckProviderFactory() AppCheck.setAppCheckProviderFactory(providerFactory)Swift
let providerFactory = YourAppCheckProviderFactory() AppCheck.setAppCheckProviderFactory(providerFactory)Objective-C
YourAppCheckProviderFactory *providerFactory = [[YourAppCheckProviderFactory alloc] init]; [FIRAppCheck setAppCheckProviderFactory:providerFactory];
AppDelegate
: Places Swift SDK for iOS
AppCheck.setAppCheckProviderFactory(DeviceCheckProviderFactory())Swift
AppCheck.setAppCheckProviderFactory(DeviceCheckProviderFactory())Objective-C
[FIRAppCheck setAppCheckProviderFactory:providerFactory];
Create a file called AppCheckTokenProvider
(or, if you are using Objective-C, two files called AppCheckTokenProvider.h
and AppCheckTokenProvider.m
) at the root level of your app. Add the following import statements and class definition:
// AppCheckTokenProvider.swift import FirebaseAppCheck import Foundation import GooglePlacesSwift struct TokenProvider: AppCheckTokenProvider { func fetchAppCheckToken() async throws -> String { return try await AppCheck.appCheck().token(forcingRefresh: false).token } }Swift
// AppCheckTokenProvider.swift import FirebaseAppCheck import Foundation import GooglePlaces class AppCheckTokenProvider: NSObject, GMSPlacesAppCheckTokenProvider { func fetchAppCheckToken() async throws -> String { return try await AppCheck.appCheck().token(forcingRefresh: false).token } }Objective-C
// AppCheckTokenProvider.h @import Foundation; @import GooglePlaces; @interface AppCheckTokenProvider : NSObject <GMSPlacesAppCheckTokenProvider> @end // AppCheckTokenProvider.m #import "AppCheckTokenProvider.h" @import FirebaseAppCheck; @implementation AppCheckTokenProvider - (void)fetchAppCheckTokenWithCompletion:(nonnull GMSAppCheckTokenCompletion)completion { [[FIRAppCheck appCheck] tokenForcingRefresh:NO completion:^(FIRAppCheckToken *_Nullable token, NSError *_Nullable error) { if (token) { completion(token.token, nil); } else { completion(nil, error); } }]; } @endStep 4: Initialize the Places and App Check APIs
AppDelegate
file, initialize the Places API: Places Swift SDK for iOS
PlacesClient.provideAPIKey("YOUR_API_KEY")Swift
GMSPlacesClient.provideAPIKey("YOUR_API_KEY")Objective-C
[GMSPlacesClient provideAPIKey:@"YOUR_API_KEY"];
PlacesClient.setAppCheckTokenProvider(AppCheckTokenProvider())Swift
GMSPlacesClient.setAppCheckTokenProvider(AppCheckTokenProvider())Objective-C
[GMSPlacesClient setAppCheckTokenProvider:[[AppCheckTokenProvider alloc] init]];
If you'd like to develop and test your app locally, or run it in a continuous integration (CI) environment, you can create a debug build of your app that uses a debug secret to obtain valid App Check tokens. This lets you avoid using real attestation providers in your debug build.
To test your app in Simulator or on a test device:
Create and set the App Check debug provider factory.
This code sample handles both the debugging and production scenarios: Places Swift SDK for iOS#if targetEnvironment(simulator) let providerFactory = AppCheckDebugProviderFactory() #else let providerFactory = YourAppCheckProviderFactory() #endifSwift
#if targetEnvironment(simulator) let providerFactory = AppCheckDebugProviderFactory() #else let providerFactory = YourAppCheckProviderFactory() #endifObjective-C
if (targetEnvironment == simulator){ FIRAppCheckDebugProviderFactory *providerFactory = [[FIRAppCheckDebugProviderFactory alloc] init]; [FIRAppCheck setAppCheckProviderFactory:providerFactory]; } else { YourAppCheckProviderFactory *providerFactory = [[YourAppCheckProviderFactory alloc] init]; [FIRAppCheck setAppCheckProviderFactory:providerFactory]; }
To run your app in a CI environment:
FIRAAppCheckDebugToken
and $(APP_CHECK_DEBUG_TOKEN)
(or something similar) as the value.Create and set the App Check debug provider factory.
This code sample handles both the debugging and production scenarios: Places Swift SDK for iOS#if DEBUG let providerFactory = AppCheckDebugProviderFactory() #else let providerFactory = YourAppCheckProviderFactory() #endif AppCheck.setAppCheckProviderFactory(providerFactory)Swift
#if DEBUG let providerFactory = AppCheckDebugProviderFactory() #else let providerFactory = YourAppCheckProviderFactory() #endif AppCheck.setAppCheckProviderFactory(providerFactory)Objective-C
#if DEBUG id<FIRAppCheckProviderFactory> providerFactory = [[FIRAppCheckDebugProviderFactory alloc] init]; #else // DEBUG id<FIRAppCheckProviderFactory> providerFactory = [[YourAppCheckProviderFactory alloc] init]; #endif // DEBUG AppCheck.setAppCheckProviderFactory(providerFactory)
Before you begin enforcement, you'll want to make sure that you won't disrupt legitimate users of your app. To do this, visit the App Check metrics screen to see what percentage of your app's traffic is verified, outdated, or illegitimate. Once you see that the majority of your traffic is verified, you can enable enforcement.
See the Firebase App Check documentation for more information and instructions.
Before you enforce App Check, make sure any Web Service calls in your Cloud project use OAuth.Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-08-14 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-14 UTC."],[[["Firebase App Check safeguards your Google Maps Platform API key by verifying requests originate from authentic apps, preventing unauthorized API calls and charges."],["App Check is generally recommended, but exceptions include the original Places SDK, private/experimental apps, and server-to-server usage without public client interaction."],["Implementation involves adding Firebase, App Check library and token provider, initializing Places and App Check APIs, optionally enabling debugging, and monitoring requests before enforcing App Check."],["Considerations include attestation provider limitations and potential startup latency for users during initial token acquisition."],["Before enforcing App Check, monitor request metrics to ensure most traffic is verified and minimize disruption to legitimate users, and ensure Cloud project web service calls use OAuth."]]],["App Check secures Google Maps Platform API keys by verifying traffic origins, blocking unauthorized requests. Implementation steps include: adding Firebase and the App Check library, setting up a token provider, initializing APIs, and enabling debugging. Monitor app request metrics via the Firebase console to assess traffic legitimacy before enabling enforcement. App Check is unnecessary for private, experimental, or server-to-server apps, and is only compatible with the Places SDK (New). Ensure any web service calls in the Cloud project use OAuth.\n"]]
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4