Firebase AppCheck Error 403: App attestation failed

Question

I have added appcheck to my Flutter app. However, this does not work properly. I use Android and have entered all the keys correctly. However, every time I start the app, the following messages appear:

IntegrityService : requestIntegrityToken(IntegrityTokenRequest{nonce=<<long code>>, cloudProjectNumber=<<project number>>, network=null})
I/PlayCore(19441): UID: [10759]  PID: [19441] IntegrityService : Initiate binding to the service.
I/PlayCore(19441): UID: [10759]  PID: [19441] IntegrityService : ServiceConnectionImpl.onServiceConnected(ComponentInfo{com.android.vending/com.google.android.finsky.integrityservice.IntegrityService})
I/PlayCore(19441): UID: [10759]  PID: [19441] IntegrityService : linkToDeath
I/PlayCore(19441): UID: [10759]  PID: [19441] OnRequestIntegrityTokenCallback : onRequestIntegrityToken
I/PlayCore(19441): UID: [10759]  PID: [19441] IntegrityService : Unbind from service.
W/LocalRequestInterceptor(19441): Error getting App Check token; using placeholder token instead. Error: com.google.firebase.FirebaseException: Error returned from API. code: 403 body: App attestation failed.

The problem is that all backend requests are unauthorised. How can I fix this problem?

Answer 1

please 1st verify that you have init the app check correctely.

Initialize App Check

Add the following initialization code to your app so that it runs before you use any Firebase services such as Storage, but after calling Firebase.initializeApp();

import 'package:flutter/material.dart';
import 'package:firebase_core/firebase_core.dart';

// Import the firebase_app_check plugin
import 'package:firebase_app_check/firebase_app_check.dart';

Future<void> main() async {
  WidgetsFlutterBinding.ensureInitialized();
  await Firebase.initializeApp();
  await FirebaseAppCheck.instance.activate(
    // You can also use a `ReCaptchaEnterpriseProvider` provider instance as an
    // argument for `webProvider`
    webProvider: ReCaptchaV3Provider('recaptcha-v3-site-key'),
    // Default provider for Android is the Play Integrity provider. You can use the "AndroidProvider" enum to choose
    // your preferred provider. Choose from:
    // 1. Debug provider
    // 2. Safety Net provider
    // 3. Play Integrity provider
    androidProvider: AndroidProvider.debug,
    // Default provider for iOS/macOS is the Device Check provider. You can use the "AppleProvider" enum to choose
        // your preferred provider. Choose from:
        // 1. Debug provider
        // 2. Device Check provider
        // 3. App Attest provider
        // 4. App Attest provider with fallback to Device Check provider (App Attest provider is only available on iOS 14.0+, macOS 14.0+)
    appleProvider: AppleProvider.appAttest,
  );
  runApp(App());
}

if you believe that you have init the app check correctely thel try the following.

1. verify that google-services.json correctly placed in the project.

2. try to add SHA-256 key hashes in the firebase console also try by removing and adding it again.

also it may be helpful to go through following

Use App Check with the debug provider with Flutter

After you have registered your app for App Check, your app normally won't run in an emulator or from a continuous integration (CI) environment, since those environments don't qualify as valid devices. If you want to run your app in such an environment during development and testing, you can create a debug build of your app that uses the App Check debug provider instead of a real attestation provider.