Firebase AI Logic App Check Enforcement (November 2, 2026): What Breaks and How to Fix It

If your app calls Gemini through Firebase AI Logic, check your Firebase console before November 2, 2026. From that date Firebase enforces App Check for AI Logic, and requests from app versions without it start failing. Here's how to tell whether you're affected and what to do in the next few days.

What changes on November 2

• Firebase AI Logic lets mobile and web apps call Gemini models directly, without putting an API key in the app. App Check proves each request comes from your genuine app on a real device.
• New projects set up since early July 2026 already have App Check enforced for AI Logic. Older projects had to turn it on themselves.
• From November 2, 2026, Firebase enforces it for every project that hasn't. Gemini requests without a valid App Check token are rejected.
• You can push your enforcement date back, but no later than January 21, 2027.

When a request is rejected, your app gets one of these errors:

403 PERMISSION_DENIED: To access this model, you must enforce Firebase App Check.

403 PERMISSION_DENIED: Firebase AI Logic has been deactivated in this project.

1. Check whether you're affected (5 minutes)

1. Open the Firebase console, go to Security > App Check, and open the APIs tab.
2. Find the Firebase AI Logic row. If it already says Enforced, you're done.
3. If it isn't enforced, look at the request metrics. If most recent requests are already verified, your current app version sends App Check tokens and enforcement is safe. If many are unverified, users are on versions without App Check, and they'll lose AI features on November 2.

2. Add App Check on Android

Use the Play Integrity provider for production builds:

// app/build.gradle.kts
implementation("com.google.firebase:firebase-appcheck-playintegrity")

// Application.onCreate(), before you use Firebase AI Logic
Firebase.initialize(context = this)
Firebase.appCheck.installAppCheckProviderFactory(
    PlayIntegrityAppCheckProviderFactory.getInstance(),
)

Register the Android app for Play Integrity in the App Check section of the console, and link your Google Cloud project to Google Play in Play Console if you haven't already.

3. Add App Check on iOS

Use App Attest. Add the App Attest capability in Xcode, then set the provider factory before Firebase starts:

import FirebaseCore
import FirebaseAppCheck

class AppAttestFactory: NSObject, AppCheckProviderFactory {
  func createProvider(with app: FirebaseApp) -> AppCheckProvider? {
    return AppAttestProvider(app: app)
  }
}

// Before FirebaseApp.configure()
AppCheck.setAppCheckProviderFactory(AppAttestFactory())
FirebaseApp.configure()

App Attest needs iOS 14 or later. If you support older versions, return a DeviceCheckProvider for them instead.

4. Add App Check in Flutter

import 'package:firebase_app_check/firebase_app_check.dart';
import 'package:firebase_core/firebase_core.dart';

Future<void> main() async {
  WidgetsFlutterBinding.ensureInitialized();
  await Firebase.initializeApp();
  await FirebaseAppCheck.instance.activate(
    androidProvider: AndroidProvider.playIntegrity,
    appleProvider: AppleProvider.appAttestWithDeviceCheckFallback,
  );
  runApp(const MyApp());
}

If you use firebase_ai 3.11.0 or older, also pass appCheck: FirebaseAppCheck.instance when you create the AI Logic instance. On the web, use the reCAPTCHA Enterprise provider.

5. Keep local testing working

Once App Check is enforced, emulators and debug builds need the debug provider. Install it in debug builds only, copy the debug token it prints, and add it in the console under App Check > Apps > Manage debug tokens. Don't commit the token to a public repo and don't ship the debug provider in a release build.

6. Need more time? Delay enforcement

If your live app versions don't send App Check tokens yet, shipping an update today won't reach everyone by Monday. To avoid breaking AI features for them:

1. In the Firebase console, open Security > App Check > APIs.
2. In the Firebase AI Logic row, click the edit icon next to Enforces:.
3. Pick a later date (January 21, 2027 at the latest) and save.

Then release an update with App Check, watch the verified share climb, and enforce once most traffic is verified. Until then your Gemini quota is open to anyone who copies your app's config, so keep the delay short.

Optional: replay protection

By default an App Check token can be reused until it expires (between 30 minutes and 7 days). Replay protection makes every Gemini call use a fresh, single-use token that lives for 5 minutes, which stops someone replaying a captured token. Turn on useLimitedUseAppCheckTokens in the app first, watch the “Unverified: Reused token” metric drop, then enforce replay protection in the console.

Checklist before November 2

• Firebase AI Logic row checked in App Check > APIs.
• App Check added on Android, iOS, Flutter and web builds that call Gemini.
• Debug tokens registered for your team's test devices.
• An app update released, or enforcement delayed while users update.
• Error handling in place for 403 PERMISSION_DENIED so the app shows a friendly message, not a crash.

Building with Firebase for push notifications too? See our guides on Firebase iOS push notifications and Flutter push notifications not received in the background. For more platform changes like this one, read WhatsApp API changes in 2026.

Frequently asked questions