Firebase App Check Brings reCAPTCHA Enterprise to Mobile Apps

Firebase App Check added reCAPTCHA Enterprise as an attestation provider for mobile apps on August 15, 2026, covering Apple platforms, Android and Flutter in one preview release (Firebase release notes). Until now, reCAPTCHA Enterprise was an App Check option for web apps only; mobile developers were limited to the platform-specific device checks.

What actually changed

App Check exists to confirm that requests hitting a Firebase backend (Firestore, Cloud Functions, Realtime Database) come from a real, unmodified instance of an app, not a script or a tampered client. Its mobile attestation has always run on device-integrity signals: Play Integrity on Android, App Attest and DeviceCheck on Apple platforms (Firebase App Check docs). Web apps got a different option, reCAPTCHA v3 or reCAPTCHA Enterprise, because there’s no OS-level integrity API to check in a browser.

The new release gives mobile a reCAPTCHA Enterprise provider of its own, documented first for Apple platforms (Get started using App Check with reCAPTCHA Enterprise on Apple platforms). It doesn’t replace Play Integrity or App Attest. It sits alongside them as an alternative provider, score-based like the web version, so it runs in the background without prompting a user to solve a challenge.

Why reCAPTCHA Enterprise, not v3

reCAPTCHA Enterprise carries more fraud signals than reCAPTCHA v3 and comes with its own free tier: up to 10,000 assessments a month at no cost. Turning it on for a mobile app means installing the reCAPTCHA Enterprise SDK, enabling the provider in the Firebase console, and redownloading the app’s config file so it picks up the new registration.

The feature ships in Preview, which Google’s own docs flag plainly: no SLA, no deprecation policy, and it can change in backwards-incompatible ways before it graduates. Google says the rollout is gradual and should reach all projects within days of the release.

Where this fits

Firerun’s take: this is a consolidation move more than a new capability. Play Integrity and App Attest already confirm a request comes from an unmodified app on an unmodified device, and neither is going away. What reCAPTCHA Enterprise adds is a second signal source, the same one already used on web, Cloud Armor and reCAPTCHA-protected forms elsewhere in a Google Cloud stack. For a team that’s already standardized fraud scoring on reCAPTCHA Enterprise, this closes the last gap between web and mobile without a separate integration.

Don’t rip out an existing Play Integrity or App Attest setup for this today. Preview status means the API surface can still move, and App Check’s whole value is reliability at the request layer, not the place to bet production traffic on a feature Google hasn’t committed to yet. Test it in a side project now. Save the production rollout for GA.