On this page
Starting November 2, 2026, Firebase can automatically enforce App Check for Firebase AI Logic in a project (if it is not already enforced). The goal, per the October 27, 2026 Firebase release notes, is to help protect the Gemini API when it is reached through Firebase AI Logic. Requests that do not carry a valid App Check token are blocked. That block covers released app builds that never wired a production attestation provider—not just unfinished local builds.
This guide is a migration and troubleshooting checklist for that window: confirm the call path, decide whether a temporary delay is needed, attach production attestation, watch request / App Check metrics, then enable or confirm enforcement. Scope stays on Firebase AI Logic—not every Gemini API call. Direct Gemini API traffic that never goes through Firebase AI Logic is a different surface and is not what this November 2 auto-enforcement notice targets.
Check the project's Firebase console Security > App Check page and live request metrics for when enforcement actually flipped. For reference only.
What changed on the planned enforcement date
Firebase’s October 27, 2026 release notes state that auto-enforcement of App Check for Firebase AI Logic can begin on November 2, 2026, and that projects can temporarily delay that auto-enforcement when older released builds still lack App Check. The Firebase AI Logic FAQ repeats the same calendar and adds the hard stop: after January 21, 2027, delaying auto-enforcement for Firebase AI Logic is no longer possible.
Official wording does not publish a specific UTC hour or named timezone for the flip. Reading “November 2” as a calendar date is safer than inventing a midnight cutoff.
When enforcement is on, the FAQ’s failure mode is blunt: any request to Firebase AI Logic without a valid App Check token is blocked, including traffic from released versions that never implemented a production attestation provider. Dev builds that still work with a debug token can therefore look fine while a store-listed build fails—exactly the split many teams report as “it works in development, some production versions call and fail.”
Step 1 — Confirm the call path is Firebase AI Logic
Before changing enforcement dates, confirm that failing traffic is actually going through Firebase AI Logic client SDKs / the Firebase AI Logic path, not a bare Gemini Developer API or Agent Platform Gemini API call from a backend that never touches App Check for this product.
Practical checks:
- Client initialization uses the Firebase AI Logic SDK entry points (mobile, web, Flutter, Unity as applicable), not a server-only Gemini client that bypasses App Check entirely.
- The Firebase project has Firebase AI Logic enabled, and the failing surface is an app that talks to Gemini via that product.
- Error timing lines up with App Check enforcement for the AI Logic API row in Security > App Check > APIs, not with an unrelated API-key, quota, or model-name 404.
If the call never uses Firebase AI Logic, this November 2 App Check auto-enforcement notice is the wrong playbook. That other path belongs on its own docs.
Related DigIntoAI context on Gemini API request-storage defaults (a different Gemini API change, not App Check): Gemini API Now Stores Generate Content Requests by Default on New Paid Projects.
Step 2 — Temporary delay only as a migration buffer
If end users are still on builds without App Check, Firebase allows a temporary delay of auto-enforcement:
- Open the Firebase console.
- Go to Security > App Check > APIs.
- Find the Firebase AI Logic row.
- Use the Enforces date picker (edit control at the end of the row).
- Pick a future enforcement date no later than January 21, 2027, then save.
The FAQ is explicit: January 21, 2027 is the last selectable date; after that date, delaying auto-enforcement for Firebase AI Logic is not available.
Delay is not a long-term “leave verification off” recipe. While enforcement is delayed and App Check is not enforced for Firebase AI Logic, official docs warn that access to the Gemini API remains vulnerable to abuse. The buffer is for shipping attestation and migrating users—then turning enforcement back on (or letting the chosen date fire). The date picker is not a permanent off switch.
Step 3 — Wire production attestation by platform
For already-released apps, the FAQ’s migration sequence is: delay if needed → implement a production attestation provider as soon as possible → monitor requests → enforce. Providers listed for Firebase AI Logic / App Check in that FAQ:
| Platform | Production attestation providers (as listed) |
|---|---|
| Apple platforms | DeviceCheck, App Attest, or reCAPTCHA Enterprise |
| Android | Play Integrity or reCAPTCHA Enterprise |
| Web | reCAPTCHA Enterprise |
| Flutter | Supports the providers above, including reCAPTCHA Enterprise |
| Unity | Supports the providers above (reCAPTCHA Enterprise support described as coming soon in the FAQ) |
The matching production attestation provider for the shipping platform goes in next, following the current App Check setup docs for that stack, then a new build so end users leave the unattested binary behind. The FAQ also notes that enabling limited-use tokens during App Check setup keeps the door open for later replay protection (one-time-use tokens)—optional enhanced protection, not a substitute for baseline enforcement.
Attestation vendors that are not on the official list for this product are outside the FAQ matrix.
Step 4 — Watch request and App Check metrics before declaring safe
After attestation ships, watch traffic until almost all recent requests look verified. The FAQ’s decision rule is qualitative: when nearly all recent requests come from verified clients, enforcing App Check is the safer next step. The Firebase console App Check / request views for that project are the better signal than a single-device test.
Typical signals to reconcile:
- Share of verified vs unverified requests for Firebase AI Logic.
- Whether older store builds still generate unverified volume.
- Whether a staged rollout of the attested build is actually replacing the unattested cohort.
Only after those numbers look healthy should enforcement be treated as “safe to keep on” for that project’s user base.
Step 5 — Enable or confirm enforcement
If App Check for Firebase AI Logic is not yet enforced, enforce it once attestation coverage is acceptable. If Firebase already auto-enforced on or after November 2 (and no delay was set), confirm the Enforces state on the APIs tab and keep monitoring.
Reminder from the FAQ: if App Check for Firebase AI Logic has not been enforced by the planned date and no delay was configured, Firebase can auto-enforce it. Waiting without a delay plan is how released-but-unattested users get blocked.
Local development while enforcement stays on
Enforcement does not have to be turned off for local work. The FAQ states that when App Check is enforced for Firebase AI Logic, local development can use the App Check debug provider while keeping enforcement enabled for the product. That keeps production protection in place and still allows debug tokens on developer machines—preferable to parking the whole project on an open delay just to run an emulator.
Checklist (short form)
- Confirm failing calls use Firebase AI Logic (not an unrelated Gemini path).
- If old unattested builds are still live, set a temporary Enforces date ≤ January 21, 2027 only as a buffer.
- Implement the listed production attestation provider for Apple / Android / Web / Flutter / Unity as applicable; ship and migrate users.
- Monitor verified vs unverified request metrics until coverage looks safe.
- Enforce or confirm App Check for Firebase AI Logic; keep the debug provider for local work with enforcement on.
- Delay is not a permanent disable—abuse risk remains while enforcement is off.
Scope notes
Scope stays Firebase AI Logic—not every Gemini API call on the internet. Delay is only a migration buffer; past the allowed window App Check cannot stay off long-term. Official notes do not publish a UTC hour for the flip; when console labels move, the Firebase release notes and the Firebase AI Logic App Check FAQ take priority.
For the planned auto-enforcement window, the operational question is simple: is the client path Firebase AI Logic, does each shipping platform present a valid App Check token from a listed production attestation provider, and is enforcement confirmed in Security > App Check with metrics that match what the team expects?