Docs

Firebase AI Logic App Check Enforcement Tracking

Firebase now enforces App Check on AI Logic calls to Gemini — track attestation failures before a security fix looks like a broken AI feature.

Performance

Firebase AI Logic — the SDK most teams use to wire Gemini calls directly into a mobile or web client — started automatically enforcing App Check in early July 2026. Previously App Check was opt-in: a request to the Gemini API from an app would go through whether or not the client could prove it was a genuine, unmodified instance of the app. Now every AI Logic call needs a valid attestation token, and anything without one gets rejected before it reaches the model. That’s a real security improvement — it closes off a class of abuse where someone extracts an API key and hammers a Gemini endpoint from outside the app entirely. It also means a whole category of request that used to fail silently, or not fail at all, now shows up as a denial in normal traffic.

The problem is that denial looks identical to a broken feature from a support ticket or a crash-free-rate dashboard. A user on a rooted device, an outdated app build, an unusual network path, or a region where Play Integrity attestation is flaky will start seeing their AI feature fail outright, and unless App Check denials are logged as their own event with their own reason code, a team investigating “the chat feature stopped working for some users” has no way to tell an attestation failure apart from a timeout, a quota limit, or a genuine bug. Rolling this out without dedicated tracking means the first sign of a problem is a spike in one-star reviews, not a graph.

Data Points to Track

  • App Check verification result per AI Logic call — pass, fail, or debug-token bypass — logged as a first-class property on every model-call event, not inferred from a generic error code
  • Denial reason breakdown — expired token, attestation provider failure (Play Integrity, DeviceCheck, reCAPTCHA Enterprise), missing token entirely — since each points to a different fix
  • Attestation success rate segmented by platform and provider, since Play Integrity, Apple DeviceCheck, and reCAPTCHA Enterprise fail independently and a drop in one shouldn’t be read as a global outage
  • Latency added by the App Check verification step, tracked separately from model inference latency, so a slow attestation call isn’t misattributed to Gemini itself
  • Denial rate by app version and OS version, to catch cases where an older build was never configured for App Check and is failing outright rather than intermittently

Setup Steps

  1. Enable the App Check debug provider in every pre-release build so QA and internal testing don’t get flagged as abuse before you’ve had a chance to verify the production attestation flow.
  2. Instrument a distinct event or property for App Check outcome on every AI Logic request, separate from the model response event, so denials are queryable on their own.
  3. Break out denial reason codes explicitly rather than logging a single generic “AI request failed” event — the fix for an expired token is different from the fix for an unsupported device.
  4. Cross-reference denial spikes against app version rollout, since a build that shipped before App Check was enforced, or without the attestation SDK configured correctly, will show a distinct signature by version.
  5. Set an alert threshold on denial rate, separate from your general error-rate alerting, since a rise here is a configuration or attestation-provider issue, not typically a model or backend problem.

Actionable Insights

If denials cluster on a specific app version, that version wasn’t shipped with App Check configured correctly and needs a patch, not a Gemini-side investigation. If denials cluster on one attestation provider — Play Integrity failing on a specific device tier, say — that’s a platform-side reliability issue to monitor and potentially route around with a fallback rather than something your own release can fix directly. And if overall AI-feature engagement drops right after App Check enforcement went live but total denial volume is low, look at added latency first: users abandon a slow response before they ever hit an outright denial.

Expert help

Need help tracking this in your app?

Our team sets up analytics pipelines for mobile and web teams every day. Talk to us and get your first events flowing in under an hour.

Talk to an expert