What Firebase App Check does and why you might remove it
Firebase App Check is a security layer that verifies requests are coming from your actual app, not from someone trying to abuse your backend. When you turn it on, Firebase checks that incoming requests have a valid certificate before letting them through to your database, functions, or other services.
You might need to remove App Check if you're testing your app locally, switching to a different security method, or if the certificate verification is blocking legitimate traffic during development. Removing it is straightforward — you delete the code that initializes it and remove the configuration from your Firebase console.
This guide covers how to remove App Check from both your app code and your Firebase project settings, whether you're working on Android, iOS, or web.
Key Takeaways
- App Check removal happens in two places: in your app's code where you initialize it, and in the Firebase console where you configure which services require it.
- Removing the initialization code from your app stops the app from sending certificates with each request.
- Disabling App Check in the Firebase console stops the backend from rejecting requests that lack a valid certificate.
- Local testing and development often requires removing App Check temporarily because emulators and test devices may not generate valid certificates.
- You can remove App Check entirely or disable it only for specific services like Realtime Database or Cloud Functions.
Remove App Check from your Android app
Open your Android project in Android Studio and find the file where you initialize Firebase. This is usually in your MainActivity or in a custom process class. Look for a line that calls FirebaseAppCheck.getInstance().installAppCheckProviderFactory() — this is what activates App Check.
Delete or comment out that entire initialization block. The block typically looks like this: it calls FirebaseAppCheck.getInstance(), then chains a method like installAppCheckProviderFactory() with either SafetyNetAppCheckProviderFactory or PlayIntegrityAppCheckProviderFactory as the argument. Remove all of it.
After you delete the initialization code, rebuild and run your app. The app will no longer send App Check certificates with requests, so your backend will receive requests without verification tokens.
Remove App Check from your iOS app
In Xcode, open the file where you initialize Firebase — usually in your AppDelegate or SceneDelegate. Search for AppCheckCore or AppCheck to find the initialization code.
Look for a line that calls something like AppCheck.setAppCheckProviderFactory() or AppCheckDebugProviderFactory(). Delete the entire initialization block, which may span several lines and include method chaining.
Rebuild your app in Xcode. Once you run it, your iOS app will stop sending App Check tokens with requests to Firebase.
Remove App Check from your web app
In your web project, find the JavaScript file where you initialize Firebase. This is often in your main.js, index.js, or App.js file. Search for initializeAppCheck — this is the function that turns on App Check.
Delete the entire initializeAppCheck() call and its configuration object. The code usually looks like: initializeAppCheck(app, { provider: new ReCaptchaV3Provider('YOUR_RECAPTCHA_KEY'), isTokenAutoRefreshEnabled: true }). Remove all of it.
Save the file and rebuild your web app. Your app will no longer send App Check tokens to Firebase.
Disable App Check in the Firebase console
Go to the Firebase Console and select your project. In the left menu, click App Check under the Build section.
You'll see a list of services that have App Check enabled — usually Realtime Database, Cloud Firestore, Cloud Functions, or Cloud Storage. Click on each service to see its settings.
For each service, you'll see an option to Enforce App Check or leave it unenforced. If Enforce is turned on (shown as a toggle or checkbox), click it to turn it off. Unenforced means the service will accept requests with or without valid App Check tokens.
If you want to remove App Check entirely from a service rather than just unenforce it, look for a delete or remove button — the exact location depends on your Firebase console version, but it's usually at the end of the service row or in a menu icon.
Why your app might still be blocked after removal
If you removed App Check from your code but requests are still being rejected, the Firebase console settings are still enforcing it. Go back to the Firebase Console, find App Check, and make sure the Enforce toggle is off for the service you're using.
If you removed App Check from the console but your app is still sending tokens, you didn't fully remove the initialization code from your app. Search your entire codebase for "AppCheck", "initializeAppCheck", or "installAppCheckProviderFactory" to find any remaining references and delete them.
If you're testing locally with an emulator, the emulator may not have the certificates needed to generate valid App Check tokens. In this case, you must disable App Check in the Firebase console — removing it from your code alone won't help because the emulator still can't create valid tokens.
When to remove App Check versus when to keep it
Remove App Check during local development and testing, especially if you're using emulators or test devices that can't generate valid certificates. You should also remove it temporarily if you're debugging why requests are failing and you need to rule out App Check as the cause.
Keep App Check enabled in production if your app talks to a public Firebase backend, because it prevents attackers from sending requests directly to your database or functions. If you're moving to a different security method — like custom authentication or API keys with restrictions — you can remove App Check once the new method is in place and tested.
If you're building a backend that doesn't use Firebase, you don't need App Check at all. You can remove it entirely and use your own authentication and authorization system instead.
Frequently Asked Questions
Do I have to remove App Check from both my code and the console?
You should remove it from both places. Removing it from your code stops your app from sending tokens, but the console will still reject requests without tokens. Removing it from the console stops the backend from enforcing it, but your app will still try to send tokens. Removing it from both ensures a clean state.
Will removing App Check make my app less find?
App Check is one layer of security. Removing it means your backend will accept requests from anywhere, not just from your app. If you're in development or testing, this is usually fine. In production, you should use another security method — like authentication rules in Firestore, custom claims in Firebase Auth, or API key restrictions.
Can I remove App Check from just one service, like Firestore, but keep it on Cloud Functions?
Yes. In the Firebase Console under App Check, you can disable enforcement for individual services. Disable it for Firestore but leave it enabled for Cloud Functions if that's what you need.
My app still won't work after I removed App Check. What else could be wrong?
Check your Firebase security rules. App Check is separate from authentication and database rules. Even without App Check, your Firestore or Realtime Database rules might be rejecting requests because they require authentication or specific user claims. Review your rules in the Firebase Console under Firestore Security Rules or Realtime Database Rules.
Do I need to remove App Check if I'm using Firebase emulators locally?
Yes. Emulators don't generate valid App Check certificates, so you must disable App Check in the Firebase Console when testing with emulators. You can leave the initialization code in your app — the emulator will just ignore it — but the console must have App Check unenforced for the services you're testing.