When you call an API directly from a mobile or web app (for example, the APIs that allow access to generative AI models), the API is vulnerable to abuse by unauthorized clients. To help protect these APIs, you can use Firebase App Check to verify that all incoming API calls are from your actual app.
Firebase AI Logic provides a proxy gateway that lets you integrate with Firebase App Check and protect the generative AI model APIs called by your mobile and web apps. Using App Check with the Firebase AI Logic SDKs supports all our configurations:
Protects both "Gemini API" providers: Gemini Developer API and Vertex AI Gemini API.
Protects all supported models, both Gemini models and Imagen models.
High-level summary of how App Check works
With App Check, devices running your app use an app or device attestation provider that verifies one or both of the following:
- Requests originate from your authentic app
- Requests originate from an authentic, untampered device
This attestation is attached to every request your app makes using a Firebase AI Logic SDK. When you enable App Check enforcement, requests from clients without a valid attestation will be rejected, as will any request originating from an app or platform you haven't authorized.
You can find detailed information about App Check in its documentation, including its quotas and limits.
Available providers and implementation instructions
App Check has built-in support for using the following services as attestation providers. Click a provider's link to view the App Check documentation for that provider, including descriptions and implementation instructions.
- Apple platforms: DeviceCheck or App Attest
- Android: Play Integrity
- Web: reCAPTCHA Enterprise
- Flutter: Supports all the providers above
(see specific Flutter instructions)
- Also see special instantiation requirements for Flutter and App Check
- Unity: Supports all the providers above (see specific Unity instructions)
If these providers are insufficient for your needs, you can also implement your own service that uses either a third-party attestation provider or your own attestation techniques (for more details, see the App Check documentation).
Special instantiation required for Flutter
|
Click your Gemini API provider to view provider-specific content and code on this page. |
When using App Check with Firebase AI Logic in Flutter apps, you need to explicitly pass in App Check during instantiation, like so:
// ...
final ai = await FirebaseAI.googleAI(
appCheck: FirebaseAppCheck.instance, // for Flutter, pass in App Check explicitly
);
// ...
Understand how Firebase AI Logic integrates with App Check
To use the Firebase AI Logic SDKs, the
Firebase AI Logic API (firebasevertexai.googleapis.com)
must be enabled in your Firebase project. This is because requests made by the
Firebase AI Logic SDKs are first sent to the Firebase AI Logic
server, which acts as a proxy gateway where Firebase App Check verification
takes place before the request is allowed to proceed to your chosen
"Gemini API" provider's backend and the APIs to access the Gemini
and Imagen models.