Firebase AI features stopped working on Nov 2? It's App Check. Here's the safe fix

Firebase AI Logic calls blocked since Nov 2, 2026? App Check is now enforced. Set up reCAPTCHA Enterprise, delay if needed, and never ship a debug token.

If your app's Gemini features broke on November 2, 2026, and they run through Firebase AI Logic (formerly Vertex AI in Firebase), the likely cause is App Check. Firebase now requires it. The safe fix is to add a real App Check provider to your app. If you need time, you can delay enforcement in the console until January 21, 2027 at the latest. Do not paste a debug token into your live code to make the error go away.

What changed

In Firebase's words: "Starting November 2, 2026, Firebase will automatically enforce Firebase App Check for Firebase AI Logic in your Firebase project (if it's not already enforced)." Once that happens, "any requests to Firebase AI Logic without a valid App Check token will be blocked."

That includes app versions your users already have. Firebase says requests from versions without App Check "will be blocked starting November 2, 2026."

Projects set up through the Firebase console since early July 2026 already had App Check enforced. Older projects, and anyone who turned it off, are the ones hitting this now. It applies to every platform the SDKs cover: web, Apple, Android, Flutter and Unity.

How to check

In the Firebase console, open Security > App Check > APIs and find the row for Firebase AI Logic. That row shows whether App Check is enforced and when automatic enforcement happens.

Firebase's docs don't publish the exact error a blocked request gets after this change. If your AI calls started failing on November 2 and this row says enforced, App Check is the place to look.

The fix for web apps

Firebase lists reCAPTCHA Enterprise as the web provider for AI Logic. It is invisible to users and has no checkbox.

1. In Google Cloud, create a score-based reCAPTCHA Enterprise key for your domains. Do not add localhost to a production key, and leave the checkbox challenge off.
2. In the Firebase console, go to Security > App Check > Apps and register your web app with that key.
3. Add this before any AI Logic call:

import { initializeAppCheck, ReCaptchaEnterpriseProvider } from "firebase/app-check";

initializeAppCheck(app, {
  provider: new ReCaptchaEnterpriseProvider("YOUR_RECAPTCHA_ENTERPRISE_SITE_KEY"),
  isTokenAutoRefreshEnabled: true,
});

Already using reCAPTCHA v3 for App Check? Firebase recommends Enterprise for new setups and asks v3 apps to upgrade.

For mobile apps, Firebase lists Play Integrity on Android and App Attest or DeviceCheck on Apple platforms. reCAPTCHA Enterprise works on both too.

Need more time? Delay it, then finish the fix

1. Go to Security > App Check > APIs.
2. Find the Firebase AI Logic row.
3. At the end of the row, click the edit icon next to Enforces:.
4. Pick a date. The last possible date is January 21, 2027.
5. Click Save.

A delay is not a fix. Firebase warns that while App Check isn't enforced, "access to the Gemini API is vulnerable to abuse." Use the time to ship the provider, then turn enforcement back on.

Do not do this

Do not set FIREBASE_APPCHECK_DEBUG_TOKEN to a token in your live JavaScript.

The debug provider is for your own laptop and CI. A registered debug token lets requests through "from unverified devices." If it ships in your site's code, anyone can copy it from the browser and call Gemini as your app. That uses your AI quota, and on a paid plan it runs up your bill. Firebase says it plainly: "do not ship your debug token or debug build in production builds of your app."

Keep debug mode behind a development check, so it never reaches the production build:

if (import.meta.env.DEV) self.FIREBASE_APPCHECK_DEBUG_TOKEN = true;

If a debug token already went live

Delete it now. In the Firebase console, go to Security > App Check > Apps, open the three-dot menu on your app, choose Manage debug tokens, and delete the token. Then ship a build without it. Firebase's instruction: "If a registered token is ever compromised, delete it immediately."

FAQ

Can I just turn App Check off?
Firebase calls this "strongly NOT recommended." Without it, your Gemini access is open to abuse. Delay instead, and only while you ship the fix.

Do I need a Gemini API key in my app now?
No. Firebase says AI Logic no longer uses Gemini API keys, and you "should not add a Gemini API key into your app's codebase."

Is my Firebase API key a problem?
It's meant to be in your code. Firebase asks you not to add the Gemini (Generative Language) API to that key's allowed APIs.

Will my old app versions keep working?
Not once enforcement is on. Versions without App Check are blocked. Delay enforcement while users update.

Sources: Firebase AI Logic docs (App Check, FAQ and troubleshooting, Error codes), Firebase App Check docs (web debug provider, reCAPTCHA Enterprise, reCAPTCHA v3), Firebase release notes (Oct 27, 2026). Checked November 2, 2026.

Want the whole pre-launch process in one place? Get App Security for Vibe Coders, our $9 PDF playbook. See what's inside.

More guides

• Is my Lovable app secure?
• How to enable Supabase Row Level Security (RLS)
• Exposed Supabase service_role key: what to do now
• Lovable security checklist