[firebase_app_check]: AppAttestProvider is selected, but generated App Check token appears to use DeviceCheck

[nathancampos-byte]

Is there an existing issue for this?

• I have searched the existing issues.

Which plugins are affected?

App Check

Which platforms are affected?

iOS

Description

I am trying to use Apple App Attest exclusively as the Firebase App Check provider on a physical iOS device.

I explicitly configure the provider as:

await FirebaseAppCheck.instance.activate(
providerApple: const AppleAppAttestProvider(),
);

I am not using appAttestWithDeviceCheckFallback.

The application is running on a physical iPhone in Release mode.

The following are correctly configured:

Apple App Attest capability is enabled in Xcode.
The App Attest entitlement is configured for production.
The application is running on a physical iOS device.
AppleAppAttestProvider is explicitly selected.
There is no DeviceCheck fallback configured.
Native investigation

I added logging to the native FlutterFire implementation to verify which provider is actually being selected.

The native plugin receives:

providerName = appAttest

and the AppCheckProviderWrapper executes:

delegateProvider = AppAttestProvider(app: app)

I also confirmed that the resulting provider is an instance of:

FIRAppAttestProvider

Therefore, it appears that FlutterFire is correctly selecting and instantiating the App Attest provider.

Unexpected result

After activating App Check, I retrieve the token using:

final token = await FirebaseAppCheck.instance.getToken(true);

However, when I decode the returned Firebase App Check JWT, the payload contains:

{
"provider": "device_check_device_identification"
}

This makes it appear that the resulting App Check token is associated with DeviceCheck rather than App Attest.

I also checked the Firebase/Google Cloud logs while requesting the token and could not find an ExchangeAppAttestAttestation operation. Instead, the behavior appears consistent with the DeviceCheck flow.

Expected behavior

Since I explicitly configure:

AppleAppAttestProvider()

I would expect the Firebase App Check token to be generated through the Apple App Attest flow, rather than DeviceCheck.

I would also expect the Firebase App Check token/provider information to indicate that App Attest was used.

Steps to reproduce
Configure Firebase in a Flutter iOS application.
Enable App Check for the Firebase project.
Configure Apple App Attest in the Apple Developer account and Xcode.
Use a physical iOS device.
Run the application in Release mode.
Configure FlutterFire with:
await FirebaseAppCheck.instance.activate(
providerApple: const AppleAppAttestProvider(),
);
Request a token:
final token = await FirebaseAppCheck.instance.getToken(true);
Decode the returned JWT.
Observe that the token contains:
"provider": "device_check_device_identification"
Additional information

I also inspected the FlutterFire native implementation.

The provider selection is definitely reaching the native layer as:

appAttest

and the native implementation creates:

AppAttestProvider(app: app)

Therefore, this does not appear to be a simple Flutter configuration issue or an accidental use of appAttestWithDeviceCheckFallback.

The main question is:

Why does an App Check token appear to be issued using DeviceCheck when AppleAppAttestProvider / FIRAppAttestProvider is explicitly configured and instantiated?

Could this be expected behavior in the underlying Firebase iOS SDK, or could there be an issue in the FlutterFire/native Firebase App Check integration?

Environment
Platform: iOS
Device: Physical iPhone
Build configuration: Release
Apple App Attest: Enabled
App Attest entitlement: Production
FlutterFire provider: AppleAppAttestProvider
DeviceCheck fallback: Not configured
firebase_app_check: 0.4.7
Firebase iOS SDK: 12.18.0

I can provide additional logs, the relevant native FlutterFire source changes, Podfile.lock, or a minimal reproduction project if needed.

Reproducing the issue

.

Firebase Core version

4.13.0

Flutter Version

3.35.7

Relevant Log Output

Flutter dependencies

Expand Flutter dependencies snippet

Replace this line with the contents of your `flutter pub deps -- --style=compact`.

Additional context and comments

No response

[SelaseKay]

Hi @nathancampos-byte, thanks for the report. We'll look into this.

[SelaseKay]

Hi @nathancampos-byte, thanks again for the report.

The JWT claim is the important part: device_check_device_identification means Firebase actually issued a DeviceCheck token. An App Attest token uses device_check_app_attest. Those names share a prefix because both APIs live in Apple’s DeviceCheck framework; they are not the same attestation. So this is not expected output from FIRAppAttestProvider.

Your native logs show FlutterFire’s AppCheckProviderWrapper switching to AppAttestProvider. That is real, but it does not prove AppCheck.appCheck().token() is using that object.

Since firebase-ios-sdk 12.15.0 (you’re on 12.18.0), App Check installs a default factory before main() and, on a physical device, vends DeviceCheck. FIRAppCheck is created eagerly inside FirebaseApp.configure() and caches that provider for the process lifetime. setAppCheckProviderFactory after configure() is ignored. Dart activate() then reconfigures the plugin wrapper — which is exactly the object you logged — while token requests can still go to the cached DeviceCheck provider. That matches the missing ExchangeAppAttestAttestation logs.

This is the same mechanism as #18613. It usually shows up when AppDelegate calls FirebaseApp.configure() (often for early Crashlytics coverage).

Could you check ios/Runner/AppDelegate and tell us:

1. Does it call FirebaseApp.configure()?
2. If yes, is that before GeneratedPluginRegistrant / super.application(...)?

If it does, Dart providerApple: AppleAppAttestProvider() cannot take effect. Either remove the native configure() and rely on Firebase.initializeApp(), or install a factory before configure():

AppCheck.setAppCheckProviderFactory(MyAppCheckProviderFactory())
FirebaseApp.configure()

Docs: https://firebase.google.com/docs/app-check/flutter/default-providers#native-configure

If there is no native configure() and you still get device_check_device_identification with getToken(true), that’s a different bug and we’ll keep this open. A Cloud log showing ExchangeDeviceCheckToken vs ExchangeAppAttestAttestation would also confirm which path ran.

Thanks!

[nathancampos-byte]

Hi, @SelaseKay

I investigated the issue further and found that my AppDelegate did originally contain FirebaseApp.configure().

Based on the suggestion that the Firebase iOS SDK may initialize App Check before FlutterFire can configure the provider, I tested both approaches:

1. Removed FirebaseApp.configure() from AppDelegate, relying on Firebase.initializeApp() from Flutter to initialize Firebase.

2. Configured a native AppCheckProviderFactory before FirebaseApp.configure(), following the official Firebase App Attest documentation. The factory explicitly returns an AppAttestProvider:

class MyAppCheckProviderFactory: NSObject, AppCheckProviderFactory {
    func createProvider(with app: FirebaseApp) -> AppCheckProvider? {
        return AppAttestProvider(app: app)
    }
}

let providerFactory = MyAppCheckProviderFactory()
AppCheck.setAppCheckProviderFactory(providerFactory)
FirebaseApp.configure()

The factory is correctly included in the Runner target and the app builds successfully.

However, in both cases, the App Check token is still generated using DeviceCheck. When I decode the token, the provider claim is:

"provider": "device_check_device_identification"

I am also using AppleAppAttestProvider() explicitly in Flutter:

await FirebaseAppCheck.instance.activate(
  providerApple: const AppleAppAttestProvider(),
);

The device is a physical iPhone running a supported iOS version, App Attest capability is enabled in Xcode, and the App Attest environment is set to Production.

So at this point, I have tried both removing the native FirebaseApp.configure() and explicitly setting an AppCheckProviderFactory before FirebaseApp.configure(), but the generated token is still a DeviceCheck token.

Could there be another initialization path in the Firebase iOS SDK / FlutterFire plugin that is causing the DeviceCheckProvider to be cached or selected despite the native AppAttestProvider factory being configured before FirebaseApp.configure()?

Additionally, when I check the Google Cloud logs for the App Check token exchange, the only operation I see is:

ExchangeDeviceCheckToken

I do not see any ExchangeAppAttestAttestation operation in the Cloud logs.

[SelaseKay]

Hi @nathancampos-byte, thanks for the extra native checks.

We could not reproduce App Attest mapping to DeviceCheck. On a physical iPhone, FlutterFire’s example with activate(providerApple: AppleAppAttestProvider()) and no FirebaseApp.configure() in AppDelegate called exchangeAppAttestAttestation.

Could you try that same path on a clean install (delete the app first so you are not looking at a cached token)?

1. AppDelegate should only call super — no FirebaseApp.configure(), no native AppCheckProviderFactory.
2. Dart:

await Firebase.initializeApp();
await FirebaseAppCheck.instance.activate(
  providerApple: const AppleAppAttestProvider(),
);
final token = await FirebaseAppCheck.instance.getToken(true);

3. Check Cloud logs for that getToken(true):
   • ExchangeAppAttestAttestation / ExchangeAppAttestAssertion → App Attest (what we saw)
   • ExchangeDeviceCheckToken → DeviceCheck still won

A successful App Attest JWT uses device_check_app_attest; device_check_device_identification is DeviceCheck.

If you still get ExchangeDeviceCheckToken on that setup, paste the full AppDelegate (including super) and we’ll keep digging. If App Attest starts showing up, the earlier DeviceCheck tokens were the first-configure() lock (#18613), not AppleAppAttestProvider itself.