Skip to main content

Firebase App Check Configuration

Overview​

Firebase App Check is controlled independently for each deployment environment through organization-level GitHub Actions variables.

App Check is disabled by default. It is enabled only when the environment-specific variable is set to the exact lowercase value true. Any other value, including an unset variable or false, disables App Check.

Organization-level variables​

Create or update the following non-secret variables in the GitHub organization's Actions variables settings.

EnvironmentOrganization variable
DEVDEV_ENABLE_FIREBASE_APP_CHECK
DEVELOPDEVELOP_ENABLE_FIREBASE_APP_CHECK
PREPRE_ENABLE_FIREBASE_APP_CHECK
PRODPROD_ENABLE_FIREBASE_APP_CHECK

Enable App Check​

  1. Open the GitHub organization settings.
  2. Go to Actions → Variables.
  3. Set the variable for the required environment to true.
  4. Deploy the apps and services mentioned in Apps/Services to Deploy.

Disable App Check​

  1. Open the GitHub organization settings.
  2. Go to Actions → Variables.
  3. Set the variable for the required environment to false.
  4. Deploy the apps and services mentioned in Apps/Services to Deploy.

Changing an organization variable does not affect already deployed builds or running services. Deploy all the components for the new value to take effect.

Apps/Services to Deploy​

Deploy the following for the target Environment

  1. Web App
  2. Admin App
  3. Callables Service

Runtime behavior​

When App Check is disabled​

  • The web app does not initialize Firebase App Check or reCAPTCHA.
  • API requests do not include the X-Firebase-AppCheck header.
  • The callable service does not register the App Check verification middleware.

When App Check is enabled​

  • The existing Firebase App Check configuration is used.
  • The web app obtains and sends App Check tokens.
  • The callable service registers its existing verification middleware.
Status: Accepted
Category: Protected
Authored By: Gladson on July 21, 2026
Revisions.