Firebase Blocks AI Logic Apps Without App Check on Nov. 2

Firebase will automatically turn on App Check for Firebase AI Logic in every project that hasn’t done so by Nov. 2, and requests without a valid token will be blocked. Firebase said in its Oct. 27 release notes that developers with released app versions lacking App Check can temporarily delay the switch.

What happens on Nov. 2

Firebase’s App Check documentation for AI Logic says that once enforcement is on, any request without a valid attestation is rejected. That includes released app versions that never shipped a production attestation provider. The page tells developers with such users to migrate them to a newer app version “as soon as possible.”

Firerun reported in July that the console’s AI Logic setup flow began enforcing App Check for new projects. Nov. 2 reaches everyone else.

How to delay it

In the Firebase console, open Security, then App Check, then the APIs tab. The Firebase AI Logic row has an “Enforces:” date picker. Firebase’s documentation sets the last possible date at Jan. 21, 2027. After that, the delay is no longer available.

The documentation warns that a delayed project leaves Gemini API access open to abuse. It lists the production providers to ship in the meantime:

• Apple platforms: DeviceCheck, App Attest or reCAPTCHA Enterprise
• Android: Play Integrity or reCAPTCHA Enterprise
• Web: reCAPTCHA Enterprise

Flutter supports all of them. Unity supports the same set, with reCAPTCHA Enterprise listed as coming soon.

What a blocked app sees

Blocked requests return a 403 PERMISSION_DENIED error. Firebase’s documentation gives the message: “To access this model, you must enforce Firebase App Check.” For local builds the documentation points to the App Check debug provider, which keeps enforcement on without breaking development.

The take

Nov. 2 is a Monday. The deadline hits hardest for teams whose apps are already in users’ hands. A web app can be redeployed in minutes. A mobile build with no attestation provider stays in the wild until users update, and every Gemini call from it fails the moment enforcement lands.

Before Nov. 2, check the App Check metrics for AI Logic to see what share of recent requests are verified. If old app versions still send unverified traffic, set the delay date now and plan the release that fixes it. Enforcement itself is the better end state: an unprotected AI Logic endpoint lets anyone who copies an app’s config run up its Gemini bill.

Key Takeaways

• Firebase auto-enforces App Check for AI Logic on Nov. 2, 2026, per its Oct. 27 release notes.
• Released app versions without App Check will get 403 errors from that date.
• The console’s date picker can push enforcement back to Jan. 21, 2027 at the latest.
• Ship App Attest, Play Integrity or reCAPTCHA Enterprise before the delay runs out.