App-Check: Adding a Debug Token to iOS

[Bilal-Abdeen]

Firebase App Check works perfectly on Android devices, Android emulators and iOS devices. However, I could not get an iOS simulator to pass the check. It throws the error message:

{"code":403,
"message":"Requests from this iOS client application <empty> are blocked.",
"errors":[{"message":"Requests from this iOS client application <empty> are blocked.",
"domain":"global",
"reason":"forbidden"}],
"status":"PERMISSION_DENIED",
"details":[{"@type":"type.googleapis.com/google.rpc.ErrorInfo",
"reason":"API_KEY_IOS_APP_BLOCKED",
"domain":"googleapis.com",
"metadata":{"service":"identitytoolkit.googleapis.com",
"consumer":"projects/123"}}]}

I followed the instructions under https://rnfirebase.io/app-check/usage#configure-a-custom-provider. For the iOS debug token, I used a token generated from the Firebase console. Some posts suggest using a token included in the error message thrown when the app check fails. I could not find this token. Running the app using npx react-native run-ios throws the error message above, which does NOT include a token!

I tried running the app using Xcode. It failed. However, I could not find a suggested token. I am NOT familiar with Xcode. It would be great if you can tell me where to find it (how to access the relevant log having the generated token.)

App.js:

useEffect(() => {
	const rnfbProvider = appCheck().newReactNativeFirebaseAppCheckProvider();
	rnfbProvider.configure({
		android: {
			provider: __DEV__ ? "debug" : "playIntegrity",
			debugToken: "ABC", // A token generated by the Firebase console. It works perfectly. 
		},
		apple: {
			provider: __DEV__ ? "debug" : "appAttestWithDeviceCheckFallback",
			debugToken: "DEF", // A token generated by the Firebase console. It does NOT work!? 
		},
		web: {
			provider: "reCaptchaV3",
			siteKey: "unknown",
		},
	});
	appCheck().initializeAppCheck({ provider: rnfbProvider, isTokenAutoRefreshEnabled: true });
}, []);

By the way, on the documentation, the iOS section for manually setting up a debug token https://rnfirebase.io/app-check/usage#on-ios is an exact copy of the 1st paragraph of the Android section! I think it has nothing to do with iOS. It needs to be updated. I started a PR to suggest deleting it. However, I thought of checking first (in this post) if there is a manual method and if there is, the details of it.

[mikehardy]

My guess is your API key is restricted too much, that's what a cursory web search appears to indicate:

https://search.brave.com/search?q=firebase+%22reason%22%3A%22API_KEY_IOS_APP_BLOCKED%22%2C

You are correct the on-ios section of the docs suffers from a copy-paste error, however the text would be correct with the single correction of the word android to ios - that is, the configuration style is the same but it needs to be in the ios configuration block of the passed in object, not the android one - a PR for the same would be most welcome

[Bilal-Abdeen]

Thank you very much for the courtesy search and the suggestion. I don't think my problem is related to API Key restrictions because of the following.

1. I don't have any API Key Restrictions. I only have app restrictions.
2. Everything works smoothly on a real/physical iPhone. I am having problems only with an iOS simulator.

Using a custom provider as suggested in the documentation https://rnfirebase.io/app-check/usage#configure-a-custom-provider works perfectly on an Android Emulator. However, it does NOT work on an iOS simulator!!!??

Moreover, I thought of getting the debug token from Xcode. However, I could not get it (Xcode) to produce one as suggested by the following instructions. https://firebase.google.com/docs/app-check/ios/debug-provider

[mikehardy]

I'm not sure how to help further, our e2e app reproduces success in all environments and is publicly available for consultation so you can use it to compare with your project

[thoth-seshat]

I have the same issue on iOS simulator. I'm using Expo (managed)