Register the actual Android app
Follow the Flutter App Check guide and confirm the Firebase app, package identity and intended Android provider. Debug, locally signed release and Play-delivered builds may have different signing identities.
App Check and Firebase Authentication serve different roles. App Check contributes app/device authenticity signals; Authentication identifies a user. Backend authorization still decides what that user may access.
Initialize before protected requests
Ensure Firebase initialization and App Check activation happen in the documented order before the app starts requests to enforced products. An early repository call can otherwise race ahead of provider setup.
Keep platform selection explicit. An Android Play Integrity setup does not automatically configure the corresponding Apple or web provider.
Test the real distribution paths
| Build path | Appropriate check |
|---|---|
| Emulator/development | Controlled debug provider setup |
| Play internal testing | Real provider and distributed signing identity |
| Production release | Provider success, metrics and supported devices |
| Alternate distribution | Provider configuration and eligibility for that channel |
Do not assume a sideloaded test behaves exactly like a Play-delivered build.
Observe before enforcing
The App Check overview explains product support and limitations. Review request metrics and legitimate-client failures before enabling enforcement for each protected service.
Test older supported app versions as well. Enforcement can block real users whose installed version has not integrated App Check yet.
Keep debug access out of production
Debug tokens are sensitive development credentials. Store them outside public source and logs, revoke unnecessary registrations and verify that the release uses the intended provider.
APKLint's Firebase Config Scanner can help inspect packaged configuration, but it cannot validate a live attestation result or see enforcement settings. The acceptance test is a legitimate request accepted through the real release path, plus a controlled invalid request rejected by the protected backend.
Sources and further reading
Reference review: 22 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
