I’m trying to use Firebase App Check to secure access to the firebase realtime-database and I’m experiencing approximately 30% to 40% of invalid tokens.

The App Check API was implemented in my app over a year ago, so I’m sure everyone is using the stable version of the app with the updated integrity API.

Either I am having unauthorized access or there is an implementation error.

When I apply the check, minutes later legitimate customers come to me to complain that they are unable to access the database, which makes me back down and unapply the check app.

I requested and managed to increase the daily quota of requests, but apparently nothing changed.

I’ve already tried contacting Firebase App Check support, but unfortunately the answers are empirical and show little interest in actually helping to solve the problem.

If anyone knows how I could audit these invalid tokens to understand what might be going on, I would be very grateful.

Below is part of the code that loads Firebase App Check on my login screen:

protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_sign_in);
    setRequestedOrientation(ActivityInfo.SCREEN_ORIENTATION_PORTRAIT);

    SplashScreen splashScreen = SplashScreen.installSplashScreen(this);

    // Initialize Google Auth login
    GoogleSignInOptions gso = new GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN).requestIdToken(getString(R.string.server_client_id)).requestEmail().build();
    mGoogleSignInClient = GoogleSignIn.getClient(this, gso);

    // Initialize Firebase
    FirebaseApp.initializeApp(this);

    // Initialize Firebase AppCheck
    FirebaseAppCheck firebaseAppCheck = FirebaseAppCheck.getInstance();
    if (DEBUG) {
        firebaseAppCheck.installAppCheckProviderFactory(DebugAppCheckProviderFactory.getInstance());
        Log.w(TAG, "Firebase App Check instaled in DEBUG mode ******************");
    } else {
        firebaseAppCheck.installAppCheckProviderFactory(PlayIntegrityAppCheckProviderFactory.getInstance());
        Log.w(TAG, "Firebase App Check instaled in RELEASE mode ******************");
    }

I appreciate any help.