Feature Flags
gustavscirulis/snapgrid
Generate feature flag infrastructure with local defaults, remote configuration, SwiftUI integration, and debug menu.
A skill your agent uses when implementing app attestation, configuring App Check providers, setting up debug tokens, enabling backend enforcement, or managing token refresh.
Install Firebase App Check
$ npx skills add evanca/flutter-ai-rules --skill firebase-app-check -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install evanca/flutter-ai-rules firebase-app-check --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/evanca/flutter-ai-rules.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/firebase-app-check .claude/skills/firebase-app-check && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "firebase-app-check" agent skill from https://github.com/evanca/flutter-ai-rules/tree/main/skills/firebase-app-check into .claude/skills/firebase-app-check/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "firebase-app-check", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/evanca/flutter-ai-rules/tree/main/skills/firebase-app-checkType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add evanca/flutter-ai-rules --skill firebase-app-check -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install evanca/flutter-ai-rules firebase-app-check --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/evanca/flutter-ai-rules.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/firebase-app-check .agents/skills/firebase-app-check && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "firebase-app-check" agent skill from https://github.com/evanca/flutter-ai-rules/tree/main/skills/firebase-app-check into .agents/skills/firebase-app-check/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "firebase-app-check", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add evanca/flutter-ai-rules --skill firebase-app-check -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install evanca/flutter-ai-rules firebase-app-check --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/evanca/flutter-ai-rules.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/firebase-app-check .cursor/skills/firebase-app-check && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "firebase-app-check" agent skill from https://github.com/evanca/flutter-ai-rules/tree/main/skills/firebase-app-check into .cursor/skills/firebase-app-check/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "firebase-app-check", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/evanca/flutter-ai-rules.git --path skills/firebase-app-check--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add evanca/flutter-ai-rules --skill firebase-app-check -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install evanca/flutter-ai-rules firebase-app-check --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/evanca/flutter-ai-rules.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/firebase-app-check .gemini/skills/firebase-app-check && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "firebase-app-check" agent skill from https://github.com/evanca/flutter-ai-rules/tree/main/skills/firebase-app-check into .gemini/skills/firebase-app-check/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "firebase-app-check", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install evanca/flutter-ai-rules firebase-app-checkInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add evanca/flutter-ai-rules --skill firebase-app-check -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/evanca/flutter-ai-rules.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/firebase-app-check .github/skills/firebase-app-check && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "firebase-app-check" agent skill from https://github.com/evanca/flutter-ai-rules/tree/main/skills/firebase-app-check into .github/skills/firebase-app-check/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "firebase-app-check", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add evanca/flutter-ai-rules --skill firebase-app-check -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install evanca/flutter-ai-rules firebase-app-check --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/evanca/flutter-ai-rules.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/firebase-app-check .opencode/skills/firebase-app-check && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "firebase-app-check" agent skill from https://github.com/evanca/flutter-ai-rules/tree/main/skills/firebase-app-check into .opencode/skills/firebase-app-check/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "firebase-app-check", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
firebase-app-check- GitHub stars
- 649
- Token cost
- ~1.6k tokens
- SKILL.md length
- 644 words
- Files
- 1
- Skills in repo
- 37
- Repo updated
- First seen
- Licence
- MIT
At a glance
A skill your agent uses when implementing app attestation, configuring App Check providers, setting up debug tokens, enabling backend enforcement, or managing token refresh.
- Works in 5 steps: Setup and Configuration → Provider Selection → Development and Testing → …
- Implementing app attestation
- SKILL.md covers When to Use, 1. Setup and Configuration, 2. Provider Selection and 3. Development and Testing, plus 3 more sections
- Calls flutter; needs FIREBASE_APPCHECK_DEBUG_TOKEN
What it does
Firebase App Check is an agent skill from evanca/flutter-ai-rules. Use when implementing app attestation, configuring App Check providers, setting up debug tokens, enabling backend enforcement, or managing token refresh.
Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Mobile. It works with Firebase, iOS and macOS. The repository describes itself as: Flutter AI Skills and Rules for Claude, Codex, Cursor, and Other AI-Powered IDEs. The licence is MIT.
When your agent uses it
- Implementing app attestation
- Configuring App Check providers
- Setting up debug tokens
- Enabling backend enforcement
Example prompts
- “/firebase-app-check”
Requirements
- Node.js
- A credential in FIREBASE_APPCHECK_DEBUG_TOKEN
Workflow steps
5 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 7b9cce2. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
flutter
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
firebase.google.comgithub.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
FIREBASE_APPCHECK_DEBUG_TOKEN
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Firebase App Check loads about 1.6k tokens when it runs. Until then it costs about 43 tokens; SKILL.md has 644 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from evanca/flutter-ai-rules at commit 7b9cce2, republished under its MIT licence (© evanca). 644 words, ~1,612 tokens.
Download SKILL.mdSave it as
.claude/skills/firebase-app-check/SKILL.md (or your agent's skills folder).- name
- firebase-app-check
- description
- Use when implementing app attestation, configuring App Check providers, setting up debug tokens, enabling backend enforcement, or managing token refresh.
- license
- MIT
Firebase App Check Skill
This skill defines how to correctly implement Firebase App Check in Flutter applications, covering provider selection, debug configuration, enforcement rollout, and security hardening.
When to Use
Use this skill when:
- Setting up and activating Firebase App Check in a Flutter project.
- Selecting the right attestation provider for each platform.
- Configuring debug providers for development, testing, and CI.
- Enabling enforcement and monitoring App Check metrics.
- Implementing token refresh handling and custom TTL configuration.
1. Setup and Configuration
flutter pub add firebase_app_checkimport 'package:firebase_app_check/firebase_app_check.dart';Initialize App Check after Firebase.initializeApp() and before using any Firebase services:
await Firebase.initializeApp();
await FirebaseAppCheck.instance.activate(
webProvider: ReCaptchaV3Provider('recaptcha-v3-site-key'),
androidProvider: AndroidProvider.playIntegrity,
appleProvider: AppleProvider.deviceCheck,
);Setup Checklist
- Register apps in the Firebase console under Project Settings > App Check.
- For web, obtain a reCAPTCHA v3 site key from the Firebase console.
- Confirm activation completes before any Firestore, Storage, or RTDB calls.
- Consider setting a custom TTL — shorter TTLs are more secure but consume quota faster.
Native FirebaseApp.configure() on Apple Platforms
Avoid calling FirebaseApp.configure() natively in your AppDelegate — Firebase.initializeApp() already configures the native default app. If you must call it, install your AppCheckProviderFactory before configure(); otherwise the Apple SDK locks in DeviceCheck on physical devices and the appleProvider passed to activate() (including AppleProvider.debug) is silently ignored. This is easiest to miss because simulators already default to the debug provider. activate() on Android is unaffected. See flutterfire#18613.
2. Provider Selection
Android:
| Provider | Use case |
|---|---|
AndroidProvider.playIntegrity | Production (default) |
AndroidProvider.debug | Development / CI only |
Apple (iOS / macOS):
| Provider | Use case |
|---|---|
AppleProvider.deviceCheck | Production default (iOS 11+, macOS 10.15+) |
AppleProvider.appAttest | Enhanced security (iOS 14+, macOS 14+) |
AppleProvider.appAttestWithDeviceCheckFallback | App Attest with Device Check fallback |
AppleProvider.debug | Development / CI only |
Web:
| Provider | Use case |
|---|---|
ReCaptchaV3Provider | Standard reCAPTCHA v3 |
ReCaptchaEnterpriseProvider | Enhanced with additional features |
Android note: For certain Android devices, enable "Meets basic device integrity" in the Google Play console to ensure proper App Check functionality.
3. Development and Testing
Use debug providers during development to run in emulators or CI environments:
await Firebase.initializeApp();
await FirebaseAppCheck.instance.activate(
androidProvider: AndroidProvider.debug,
appleProvider: AppleProvider.debug,
);Platform-Specific Debug Setup
iOS: Enable debug logging by adding -FIRDebugEnabled to Arguments Passed on Launch in Xcode. The debug token appears in the console output. On physical devices, AppleProvider.debug is ignored if your AppDelegate calls FirebaseApp.configure() natively — see the native configure() note in Setup and Configuration.
Android: The debug token prints to logcat on first run. Filter by DebugAppCheckProvider.
Web: Set self.FIREBASE_APPCHECK_DEBUG_TOKEN = true; in web/index.html before Firebase scripts load.
Show full SKILL.md (265 more words)Show less
Register Debug Tokens
- Copy the debug token from the device/emulator console output.
- In the Firebase console, navigate to App Check > Apps > Manage debug tokens.
- Add the token. It is immediately active for that app.
Token Listener for Custom Backends
FirebaseAppCheck.instance.onTokenChange.listen((token) {
// Attach token to custom backend requests
// e.g., set as Authorization header
});- Never use debug providers or share debug tokens in production builds.
- Keep debug tokens private — do not commit them to public repositories.
- Revoke compromised debug tokens immediately from the Firebase console.
4. Enforcement Rollout
Follow this sequence to avoid disrupting legitimate users:
- Deploy App Check activation code to all app versions.
- Monitor App Check metrics in the Firebase console — wait until most traffic shows valid tokens.
- Enable enforcement gradually, starting with non-critical Firebase services (e.g., Cloud Storage before Firestore).
- Verify that unverified request percentage drops to near zero before enforcing on critical services.
- Once enforcement is enabled, only apps with valid App Check tokens can access protected Firebase resources.
- Use App Check in combination with Firebase Security Rules for defense in depth.
- Implement proper error handling for App Check verification failures — surface a user-friendly message rather than a raw error.
5. Security Best Practices
- Never disable App Check in production builds once enabled.
- Implement a fallback mechanism for App Check verification failures (e.g., retry with exponential backoff).
- Regularly review App Check metrics to identify potential abuse patterns.
- App Check tokens are automatically refreshed at approximately half the TTL duration.
- For high-security applications, use the shortest practical TTL.
- Implement server-side verification for critical operations using the Firebase Admin SDK:
// Node.js Admin SDK example for verifying App Check tokens
const appCheckToken = req.header('X-Firebase-AppCheck');
const appCheckClaims = await getAppCheck().verifyToken(appCheckToken);References
© evanca, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/firebase-app-check of evanca/flutter-ai-rules.
Open the folder on GitHubat commit 7b9cce2
Compare with similar skills
Firebase App Check next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Firebase App Check this skillevanca/flutter-ai-rules | 649 | — | ~1.6k | Automated safety check: Pass | MIT | |
| Feature Flagsgustavscirulis/snapgrid | 117 | 1 repos | ~2.6k | Automated safety check: Notes | Custom licence | |
| Git Worktree Setupk8zdev/k8z | 155 | — | ~930 | Automated safety check: Pass | None | |
| Engine Whats Newflutter/flutter | 179k | — | ~978 | Automated safety check: Pass | BSD-3-Clause | |
| Orca iOS Simulator Controlstablyai/orca | 87k | 1 repos | ~584 | Automated safety check: Pass | Apache-2.0 | |
| Apple Crash Log .NET Symbolicationdotnet/skills | 5.6k | 1 repos | ~2.4k | Automated safety check: Pass | MIT |
Similar skills
Git Worktree Setup
k8zdev/k8z
Automate git worktree creation and copy private files (not tracked in git) to new workdirs.
Engine Whats New
flutter/flutter
Generates the "what's new" release summary and diff file for changes in the Flutter engine (//engine/src/flutter) between two releases (e.g., 3.47 vs 3.44).
Orca iOS Simulator Control
stablyai/orca
iOS Simulator control from inside Orca, with the live device view in Orca's emulator pane. Use when driving a booted Apple Simulator on macOS: taps, gestures…
- Official
Apple Crash Log .NET Symbolication
dotnet/skills
Resolves .NET runtime frames in Apple .ips crash logs to function names, source files and line numbers using dSYM symbols, atos and the Microsoft symbol server.
App Store Screenshots Generator
ParthJadhav/app-store-screenshots
Scaffolds a Next.js editor for designing App Store and Google Play screenshots as ads and exporting them at every required size, for iOS, Mac and Android.
More from evanca/flutter-ai-rules
All 37 skills in this repoCode Review
evanca/flutter-ai-rules
A skill your agent uses when asked to review a PR, MR, branch, or diff, audit changed files, or check code quality.
Developing Genkit Dart
evanca/flutter-ai-rules
A skill your agent uses when building AI agents in Dart, implementing Genkit flows or tools, integrating LLMs into Dart or Flutter applications, or using Genkit Dart plugins.
Generate Images With Firebase AI
evanca/flutter-ai-rules
A skill your agent uses when generating or editing images from Flutter/Dart with Firebase AI Logic and a Gemini image model (Nano Banana), making the first call work, choosing Gemini Developer API…
Flutter Use Column Row First
evanca/flutter-ai-rules
A skill your agent uses when building any Flutter screen or component to choose responsive Row, Column, Expanded, Flexible, and Spacer layouts before fixed-size or coordinate-based alternatives.
Architecture Feature First
evanca/flutter-ai-rules
A skill your agent uses when creating a feature, designing folder structure, adding repositories/services/view models, wiring dependency injection, or deciding which layer owns logic.
Bloc
evanca/flutter-ai-rules
A skill your agent uses when creating a Cubit or Bloc, modeling state with sealed classes or status enums, wiring BlocBuilder/BlocListener/BlocProvider, writing bloc tests, or choosing between Cubit…
Related
Categories
Questions about Firebase App Check
What does Firebase App Check do?
A skill your agent uses when implementing app attestation, configuring App Check providers, setting up debug tokens, enabling backend enforcement, or managing token refresh. Firebase App Check is an agent skill from evanca/flutter-ai-rules. Use when implementing app attestation, configuring App Check providers, setting up debug tokens, enabling backend enforcement, or managing token refresh.
When should I use Firebase App Check?
Firebase App Check fits situations like: implementing app attestation; configuring App Check providers; setting up debug tokens; enabling backend enforcement.
How do I install Firebase App Check in Claude Code?
Run `npx skills add evanca/flutter-ai-rules --skill firebase-app-check -a claude-code`. Or copy the skill folder (skills/firebase-app-check in evanca/flutter-ai-rules) into .claude/skills/firebase-app-check in your project. Claude Code loads it when a task matches its description.
How do I install Firebase App Check in Codex?
Run `npx skills add evanca/flutter-ai-rules --skill firebase-app-check -a codex`. Or copy the skill folder (skills/firebase-app-check in evanca/flutter-ai-rules) into .agents/skills/firebase-app-check in your project. Codex loads it when a task matches its description.
Can I use Firebase App Check in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add evanca/flutter-ai-rules --skill firebase-app-check -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/firebase-app-check, .gemini/skills/firebase-app-check, .github/skills/firebase-app-check and .opencode/skills/firebase-app-check in your project.
What does Firebase App Check need to run?
Going by SKILL.md and its folder, Firebase App Check needs the command-line tools its instructions call (flutter) and credentials named FIREBASE_APPCHECK_DEBUG_TOKEN. Our summary lists: Node.js; A credential in FIREBASE_APPCHECK_DEBUG_TOKEN.
Does Firebase App Check access the network?
SKILL.md names 2 domains. As links in the text: firebase.google.com and github.com. This is read from the text; nothing was executed.
Is Firebase App Check safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Firebase App Check use?
Firebase App Check is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Firebase App Check use?
About 1.6k tokens (SKILL.md is roughly 6.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Firebase App Check?
Skills that share tags, products or a category with Firebase App Check: Feature Flags (gustavscirulis/snapgrid, 117 stars), Git Worktree Setup (k8zdev/k8z, 155 stars), Engine Whats New (flutter/flutter, 179k stars) and Orca iOS Simulator Control (stablyai/orca, 87k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Firebase App Check?
evanca (a GitHub user) maintains it in evanca/flutter-ai-rules, which has 649 GitHub stars. The repository holds 37 skills in this directory. The repository was last updated on September 14, 2026.
Source: evanca/flutter-ai-rules on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.