Can not generate a debug token for Firebase Storage with App Check

Question

I want to include Firebase App Check for Firebase Storage in my Android Flutter App. Therefore I was following the official documentation: https://firebase.flutter.dev/docs/app-check/usage.

This is my Kotlin MainActivity:

import android.os.Bundle
import com.google.firebase.FirebaseApp
import com.google.firebase.appcheck.FirebaseAppCheck
import com.google.firebase.appcheck.debug.DebugAppCheckProviderFactory
import io.flutter.embedding.android.FlutterActivity


class MainActivity : FlutterActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        FirebaseApp.initializeApp(/*context=*/ this);
        val firebaseAppCheck = FirebaseAppCheck.getInstance()
        firebaseAppCheck.installAppCheckProviderFactory(
                DebugAppCheckProviderFactory.getInstance())
        super.onCreate(savedInstanceState)
    }
}

and this is my main():

void main() async {
  WidgetsFlutterBinding.ensureInitialized();
  await Firebase.initializeApp();
  await FirebaseAppCheck.instance.activate();
  runApp(MyApp());
}

I also added this to my app/build.gradle

dependencies {
  implementation 'com.google.firebase:firebase-appcheck-debug:16.0.0-beta01'
}

When I make a request to firebase storage, I would expect something like this in my console:

D DebugAppCheckProvider: Enter this debug secret into the allow list in the Firebase Console for your project: 123a4567-b89c-12d3-e456-789012345678

Instead, I'm getting an error:

Error getting App Check token; using placeholder token instead. Error: com.google.firebase.FirebaseException: Error returned from API. code: 403 body: Requests from this Android client application are blocked.

Did I miss something here? I am using a real Android device with flutter debug build.

Answer 1

Try to download your google-services.json again.

If this does not help, might need to add/re-add your debug key's SHA-1 certificate after doing so, get new google-services.json

Apparently being blocked by firebase means your API key is configured improperly.

If you are getting this error:

 Error: com.google.firebase.FirebaseException: Error returned from API. code: 403 body: App attestation failed. 

Check your SafetyNet provider in the Project Settings > App Check. You will need to provide SHA-256 fingerprint of your app's signing certificate. (would also suggest increasing token live time)