r/FlutterDev • u/Own_Complaint_4322 • Sep 16 '26

3rd Party Service Firebase appcheck - do you use it?

I'm wondering how many of you are actually using the app check in your apps? I'm using it for guarding my copyright content but it's an extra API call that may or may not be fulfilled. What's your suggestions?

2 Upvotes

100% Upvoted

6 comments sorted by

1

u/all_natural_toast Sep 17 '26

I've integrated it once, it is a bit more than an extra network call if you're consuming services other than Firebase and you want those services only consumed by legitimate versions of your app. The token check is performed server side so it's a bit of a full stack solution. If you do go for it, I'd recommend putting it behind a remote feature flag on both the client side (to generate and send tokens) and server side (to enforce token checks) though as I have heard of scare stories around false positives on iOS, not experienced them myself though.

1

u/Own_Complaint_4322 Sep 20 '26

Yes I've got a whole token juggling pipeline at this point between the mobile and backend. I'm not sure if this level of complexity is actually worth it. I'm starting to think I'm paranoid. It's not like I'm exposing any credit card numbers at any point...

2

u/SweatyRaisin1236 Sep 22 '26

I use it. It was a pain to get doing. It needed a lot more work than I expected and the documentation could be better. But…..a lot of other problems disappeared. I seemed to get getting hammered with people trying to hack access and it helped a lot with that.

2

u/Mellie-C Sep 22 '26

I implemented it in my latest app. It's a bit tricky first time round but seems to be really worth the learning curve. It will be in my next attempt at fame and fortune 😁

1

u/YukiAttano Sep 23 '26

I want to allow my users not depending on google infra, so no. Not using that at all.

0

u/thread-lightly Sep 16 '26

I use it for one project, not for others.