I followed the steps described here:
https://firebase.google.com/docs/app-check/flutter/default-providers
And I set up my token here:
https://console.cloud.google.com/security/recaptcha
although it says “Finish setting up your key: Request scores”, it doesn’t seem like this applies to my flutter web app. I also switched on Disable domain verification, just to make sure it’s not blocking localhost (although I added localhost to the domains list).