Is there an existing issue for this?
Which plugins are affected?
App Check
Which platforms are affected?
iOS
Description
The debug token is no longer accepted, I get a 403 denied on the validation of the debug token: App attestation failed.
Also, on the latest version the debug token is no longer listed in the Xcode logging when I remove predefined debug token from my activate method:
/// Activate Firebase App Check
await FirebaseAppCheck.instance.activate(
providerWeb: ReCaptchaV3Provider(kWebRecaptchaSiteKey),
providerAndroid: kDebugMode
? AndroidDebugProvider(debugToken: kAndroidDebugProviderToken)
: AndroidPlayIntegrityProvider(),
providerApple: kDebugMode
? AppleDebugProvider(debugToken: kAppleDebugProviderToken)
: AppleAppAttestWithDeviceCheckFallbackProvider(),
);
When removing the kAppleDebugProviderToken, in previous versions Xcode would list the app check token so that I could add that to the debug tokens in Firebase, on the latest version it doesn't display that, it keeps saying that it's going to use the supplied debug token.
Reproducing the issue
When pinning on the versions below it WORKS, when upgrading to latest core and app check it fails with the error listed:
firebase_analytics: 12.2.0
firebase_app_check: 0.4.2
firebase_auth: 6.3.0
firebase_core: 4.6.0
firebase_crashlytics: 5.1.0
firebase_messaging: 16.1.3
firebase_remote_config: 6.3.0
firebase_storage: ^13.1.0
Firebase Core version
4.6.0
Flutter Version
3.4.0-0.3.pre
Relevant Log Output
<AppCheckCore>[I-GAC003001] Unexpected API response:
URL: https://firebaseappcheck.googleapis.com/v1/projects/[PROJECT_ID]/apps/[APP_ID]:exchangeDebugToken
Status Code: 403
Response body:
{
"error": {
"code": 403,
"message": "App attestation failed.",
"status": "PERMISSION_DENIED"
}
}
<AppCheckCore>[I-GAC004004] Failed to exchange debug token to app check token:
Error Domain=com.google.app_check_core Code=0 "The server responded with an error..."Flutter dependencies
Expand Flutter dependencies snippet
Dart SDK 3.12.0-327.4.beta
Flutter SDK 3.44.0-0.3.pre
stylesnap 2026.3.0+350
dependencies:
- app_badge_plus 1.2.10 [flutter plugin_platform_interface]
- cached_network_image_ce 4.6.4 [cached_network_image_platform_interface_ce cached_network_image_web_ce crypto file flutter hive_ce http octo_image path path_provider]
- cloud_firestore 6.2.0 [cloud_firestore_platform_interface cloud_firestore_web collection firebase_core firebase_core_platform_interface flutter meta]
- collection 1.19.1
- country_code_picker 3.4.1 [flutter collection diacritic]
- cupertino_icons 1.0.9
- dart_mappable 4.8.0 [collection meta type_plus]
- dlibphonenumber 1.1.62 [protobuf meta fixnum]
- email_validator 3.0.0
- firebase_analytics 12.2.0 [firebase_analytics_platform_interface firebase_analytics_web firebase_core firebase_core_platform_interface flutter]
- firebase_app_check 0.4.2 [firebase_app_check_platform_interface firebase_app_check_web firebase_core firebase_core_platform_interface flutter]
- firebase_auth 6.3.0 [firebase_auth_platform_interface firebase_auth_web firebase_core firebase_core_platform_interface flutter meta]
- firebase_core 4.6.0 [firebase_core_platform_interface firebase_core_web flutter meta]
- firebase_crashlytics 5.1.0 [firebase_core firebase_core_platform_interface firebase_crashlytics_platform_interface flutter stack_trace]
- firebase_messaging 16.1.3 [firebase_core firebase_core_platform_interface firebase_messaging_platform_interface firebase_messaging_web flutter meta]
- firebase_remote_config 6.3.0 [firebase_core firebase_core_platform_interface firebase_remote_config_platform_interface firebase_remote_config_web flutter]
- firebase_storage 13.2.0 [firebase_core firebase_core_platform_interface firebase_storage_platform_interface firebase_storage_web flutter mime]
- flex_color_scheme 8.4.0 [flex_seed_scheme flutter meta]
- flutter 0.0.0 [characters collection material_color_utilities meta vector_math sky_engine]
- flutter_hooks 0.21.3+1 [flutter]
- flutter_launcher_icons 0.14.4 [args checked_yaml cli_util image json_annotation path yaml]
- flutter_localizations 0.0.0 [flutter intl path]
- flutter_native_contact_picker_plus 1.3.1 [flutter plugin_platform_interface]
- font_awesome_flutter 11.0.0 [flutter]
- go_router 17.2.3 [collection flutter flutter_web_plugins logging meta]
- google_sign_in 7.2.0 [flutter google_sign_in_android google_sign_in_ios google_sign_in_platform_interface google_sign_in_web]
- image_cropper 12.2.1 [flutter image_cropper_platform_interface image_cropper_for_web]
- image_picker 1.2.2 [flutter image_picker_android image_picker_for_web image_picker_ios image_picker_linux image_picker_macos image_picker_platform_interface image_picker_windows]
- intl 0.20.2 [clock meta path]
- logger 2.7.0 [meta clock]
- package_info_plus 10.1.0 [clock ffi flutter flutter_web_plugins http meta package_info_plus_platform_interface path web win32]
- share_plus 13.1.0 [cross_file meta mime flutter flutter_web_plugins share_plus_platform_interface file url_launcher_web url_launcher_windows url_launcher_linux url_launcher_platform_interface ffi web win32]
- shared_preferences 2.5.5 [flutter shared_preferences_android shared_preferences_foundation shared_preferences_linux shared_preferences_platform_interface shared_preferences_web shared_preferences_windows]
- signals_flutter 6.3.0 [flutter signals_core]
- signals_hooks 0.4.0 [flutter flutter_hooks signals]
- skeletonizer 2.1.3 [flutter]
- slang 4.14.0 [collection intl serial_csv watcher yaml]
- slang_flutter 4.14.0 [flutter flutter_localizations slang]
- url_launcher 6.3.2 [flutter url_launcher_android url_launcher_ios url_launcher_linux url_launcher_macos url_launcher_platform_interface url_launcher_web url_launcher_windows]
- uuid 4.5.3 [crypto fixnum]
dev dependencies:
- analyzer 12.1.0 [_fe_analyzer_shared collection convert crypto glob meta package_config path pub_semver source_span watcher yaml]
- build_runner 2.15.0 [analyzer args async build build_config build_daemon built_collection built_value collection convert crypto dart_style glob graphs http_multi_server io json_annotation logging meta mime package_config path pool pub_semver shelf shelf_web_socket stream_transform watcher web_socket_channel yaml]
- dart_mappable_builder 4.8.0 [analyzer ansicolor build collection dart_mappable dart_style glob path source_gen]
- flutter_lints 6.0.0 [lints]
- flutter_test 0.0.0 [flutter test_api matcher path fake_async clock stack_trace vector_math leak_tracker_flutter_testing collection meta stream_channel]
- integration_test 0.0.0 [flutter flutter_driver flutter_test path vm_service]
- slang_build_runner 4.14.0 [build dart_style glob slang]
transitive dependencies:
- _fe_analyzer_shared 99.0.0 [meta source_span]
- _flutterfire_internals 1.3.68 [collection firebase_core firebase_core_platform_interface flutter meta]
- ansicolor 2.0.3
- archive 4.0.9 [path posix]
- args 2.7.0
- async 2.13.1 [collection meta]
- boolean_selector 2.1.2 [source_span string_scanner]
- build 4.0.6 [analyzer crypto glob logging package_config path]
- build_config 1.3.0 [checked_yaml json_annotation path pubspec_parse]
- build_daemon 4.1.1 [built_collection built_value crypto http_multi_server logging path pool shelf shelf_web_socket stream_transform watcher web_socket_channel]
- built_collection 5.1.1
- built_value 8.12.6 [built_collection collection fixnum meta]
- cached_network_image_platform_interface_ce 5.2.0 [file flutter]
- cached_network_image_web_ce 2.1.1 [cached_network_image_platform_interface_ce flutter web]
- characters 1.4.1
- checked_yaml 2.0.4 [json_annotation source_span yaml]
- cli_util 0.4.2 [meta path]
- clock 1.1.2
- cloud_firestore_platform_interface 7.1.0 [_flutterfire_internals collection firebase_core flutter meta plugin_platform_interface]
- cloud_firestore_web 5.2.0 [_flutterfire_internals cloud_firestore_platform_interface collection firebase_core firebase_core_web flutter flutter_web_plugins]
- code_assets 1.0.0 [collection hooks]
- convert 3.1.2 [typed_data]
- cross_file 0.3.5+2 [meta web]
- crypto 3.0.7 [typed_data]
- dart_style 3.1.8 [analyzer args collection package_config path pub_semver source_span yaml]
- diacritic 0.1.6
- fake_async 1.3.3 [clock collection]
- ffi 2.2.0
- ffi_leak_tracker 0.1.2 [ffi]
- file 7.0.1 [meta path]
- file_selector_linux 0.9.4 [cross_file file_selector_platform_interface flutter]
- file_selector_macos 0.9.5 [cross_file file_selector_platform_interface flutter]
- file_selector_platform_interface 2.7.0 [cross_file flutter http plugin_platform_interface]
- file_selector_windows 0.9.3+5 [cross_file file_selector_platform_interface flutter]
- firebase_analytics_platform_interface 5.1.0 [_flutterfire_internals firebase_core flutter meta plugin_platform_interface]
- firebase_analytics_web 0.6.1+4 [_flutterfire_internals firebase_analytics_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins]
- firebase_app_check_platform_interface 0.2.2 [_flutterfire_internals firebase_core flutter meta plugin_platform_interface]
- firebase_app_check_web 0.2.3 [_flutterfire_internals firebase_app_check_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins web]
- firebase_auth_platform_interface 8.1.8 [_flutterfire_internals collection firebase_core flutter http meta plugin_platform_interface]
- firebase_auth_web 6.1.4 [firebase_auth_platform_interface firebase_core firebase_core_web flutter flutter_web_plugins http_parser meta web]
- firebase_core_platform_interface 6.0.3 [collection flutter flutter_test meta plugin_platform_interface]
- firebase_core_web 3.6.0 [firebase_core_platform_interface flutter flutter_web_plugins meta web]
- firebase_crashlytics_platform_interface 3.8.19 [_flutterfire_internals collection firebase_core flutter meta plugin_platform_interface]
- firebase_messaging_platform_interface 4.7.8 [_flutterfire_internals firebase_core flutter meta plugin_platform_interface]
- firebase_messaging_web 4.1.4 [_flutterfire_internals firebase_core firebase_core_web firebase_messaging_platform_interface flutter flutter_web_plugins meta web]
- firebase_remote_config_platform_interface 2.1.1 [_flutterfire_internals firebase_core flutter meta plugin_platform_interface]
- firebase_remote_config_web 1.10.5 [_flutterfire_internals firebase_core firebase_core_web firebase_remote_config_platform_interface flutter flutter_web_plugins]
- firebase_storage_platform_interface 5.2.19 [_flutterfire_internals collection firebase_core flutter meta plugin_platform_interface]
- firebase_storage_web 3.11.4 [_flutterfire_internals async firebase_core firebase_core_web firebase_storage_platform_interface flutter flutter_web_plugins http meta web]
- fixnum 1.1.1
- flex_seed_scheme 4.0.1 [collection flutter meta]
- flutter_driver 0.0.0 [file flutter flutter_test fuchsia_remote_debug_protocol path meta vm_service webdriver matcher]
- flutter_plugin_android_lifecycle 2.0.34 [flutter]
- flutter_web_plugins 0.0.0 [flutter]
- fuchsia_remote_debug_protocol 0.0.0 [process vm_service meta]
- glob 2.1.3 [async collection file path string_scanner]
- google_identity_services_web 0.3.3+1 [meta web]
- google_sign_in_android 7.2.10 [flutter google_sign_in_platform_interface]
- google_sign_in_ios 6.3.0 [flutter google_sign_in_platform_interface]
- google_sign_in_platform_interface 3.1.0 [flutter plugin_platform_interface]
- google_sign_in_web 1.1.3 [flutter flutter_web_plugins google_identity_services_web google_sign_in_platform_interface http web]
- graphs 2.3.2 [collection]
- hive_ce 2.19.3 [meta crypto web isolate_channel json_annotation]
- hooks 1.0.3 [collection crypto logging meta pub_semver record_use yaml]
- http 1.6.0 [async http_parser meta web]
- http_multi_server 3.2.2 [async]
- http_parser 4.1.2 [collection source_span string_scanner typed_data]
- image 4.8.0 [archive meta xml]
- image_cropper_for_web 7.0.0 [flutter flutter_web_plugins image_cropper_platform_interface web]
- image_cropper_platform_interface 8.0.0 [flutter plugin_platform_interface http]
- image_picker_android 0.8.13+17 [flutter flutter_plugin_android_lifecycle image_picker_platform_interface meta]
- image_picker_for_web 3.1.1 [flutter flutter_web_plugins image_picker_platform_interface mime web]
- image_picker_ios 0.8.13+6 [flutter image_picker_platform_interface]
- image_picker_linux 0.2.2 [file_selector_linux file_selector_platform_interface flutter image_picker_platform_interface]
- image_picker_macos 0.2.2+1 [file_selector_macos file_selector_platform_interface flutter image_picker_platform_interface]
- image_picker_platform_interface 2.11.1 [cross_file flutter http plugin_platform_interface]
- image_picker_windows 0.2.2 [file_selector_platform_interface file_selector_windows flutter image_picker_platform_interface]
- io 1.0.5 [meta path string_scanner]
- isolate_channel 0.6.1 [meta]
- jni 1.0.0 [args collection ffi meta package_config path plugin_platform_interface]
- jni_flutter 1.0.1 [flutter jni]
- json_annotation 4.11.0 [meta]
- leak_tracker 11.0.2 [clock collection meta path vm_service]
- leak_tracker_flutter_testing 3.0.10 [flutter leak_tracker leak_tracker_testing matcher meta]
- leak_tracker_testing 3.0.2 [leak_tracker matcher meta]
- lints 6.1.0
- logging 1.3.0
- matcher 0.12.19 [async meta stack_trace term_glyph test_api]
- material_color_utilities 0.13.0 [collection]
- meta 1.18.0
- mime 2.0.0
- native_toolchain_c 0.17.6 [code_assets glob hooks logging meta pub_semver]
- objective_c 9.3.0 [code_assets collection ffi hooks logging native_toolchain_c pub_semver]
- octo_image 2.1.0 [flutter]
- package_config 2.2.0 [path]
- package_info_plus_platform_interface 4.1.0 [flutter meta plugin_platform_interface]
- path 1.9.1
- path_provider 2.1.5 [flutter path_provider_android path_provider_foundation path_provider_linux path_provider_platform_interface path_provider_windows]
- path_provider_android 2.3.1 [flutter jni jni_flutter path_provider_platform_interface]
- path_provider_foundation 2.6.0 [ffi flutter objective_c path_provider_platform_interface]
- path_provider_linux 2.2.1 [ffi flutter path path_provider_platform_interface xdg_directories]
- path_provider_platform_interface 2.1.2 [flutter platform plugin_platform_interface]
- path_provider_windows 2.3.0 [ffi flutter path path_provider_platform_interface]
- petitparser 7.0.2 [meta collection]
- platform 3.1.6
- plugin_platform_interface 2.1.8 [meta]
- pool 1.5.2 [async stack_trace]
- posix 6.5.0 [ffi meta path]
- preact_signals 1.9.4 [meta]
- process 5.0.5 [file path platform]
- protobuf 6.0.0 [collection fixnum meta]
- pub_semver 2.2.0 [collection]
- pubspec_parse 1.5.0 [checked_yaml collection json_annotation pub_semver yaml]
- record_use 0.6.0 [collection meta pub_semver]
- serial_csv 0.5.2
- share_plus_platform_interface 7.1.0 [cross_file flutter meta mime plugin_platform_interface path_provider uuid]
- shared_preferences_android 2.4.23 [flutter shared_preferences_platform_interface]
- shared_preferences_foundation 2.5.6 [flutter shared_preferences_platform_interface]
- shared_preferences_linux 2.4.1 [file flutter path path_provider_linux path_provider_platform_interface shared_preferences_platform_interface]
- shared_preferences_platform_interface 2.4.2 [flutter plugin_platform_interface]
- shared_preferences_web 2.4.3 [flutter flutter_web_plugins shared_preferences_platform_interface web]
- shared_preferences_windows 2.4.1 [file flutter path path_provider_platform_interface path_provider_windows shared_preferences_platform_interface]
- shelf 1.4.2 [async collection http_parser path stack_trace stream_channel]
- shelf_web_socket 3.0.0 [shelf stream_channel web_socket_channel]
- signals 6.3.0 [flutter signals_core signals_flutter]
- signals_core 6.2.1 [preact_signals meta]
- sky_engine 0.0.0
- source_gen 4.2.3 [analyzer async build dart_style glob path pub_semver source_span yaml]
- source_span 1.10.2 [collection path term_glyph]
- stack_trace 1.12.1 [path]
- stream_channel 2.1.4 [async]
- stream_transform 2.1.1
- string_scanner 1.4.1 [source_span]
- sync_http 0.3.1
- term_glyph 1.2.2
- test_api 0.7.11 [async boolean_selector collection meta source_span stack_trace stream_channel string_scanner term_glyph]
- type_plus 2.1.1
- typed_data 1.4.0 [collection]
- url_launcher_android 6.3.29 [flutter url_launcher_platform_interface]
- url_launcher_ios 6.4.1 [flutter url_launcher_platform_interface]
- url_launcher_linux 3.2.2 [flutter url_launcher_platform_interface]
- url_launcher_macos 3.2.5 [flutter url_launcher_platform_interface]
- url_launcher_platform_interface 2.3.2 [flutter plugin_platform_interface]
- url_launcher_web 2.4.3 [flutter flutter_web_plugins url_launcher_platform_interface web]
- url_launcher_windows 3.1.5 [flutter url_launcher_platform_interface]
- vector_math 2.2.0
- vm_service 15.2.0
- watcher 1.2.1 [async path]
- web 1.1.1
- web_socket 1.0.1 [web]
- web_socket_channel 3.0.3 [async crypto stream_channel web web_socket]
- webdriver 3.1.0 [matcher path stack_trace sync_http]
- win32 6.1.0 [code_assets crypto ffi ffi_leak_tracker hooks logging meta native_toolchain_c]
- xdg_directories 1.1.0 [meta path]
- xml 6.6.1 [collection meta petitparser]
- yaml 3.1.3 [collection source_span string_scanner]
Additional context and comments
Same issue posted on StackOverflow:
https://stackoverflow.com/questions/79881432/firebase-app-check-ios-debug-token-403-app-attestation-failed-despite-correct
Is there an existing issue for this?
Which plugins are affected?
App Check
Which platforms are affected?
iOS
Description
The debug token is no longer accepted, I get a 403 denied on the validation of the debug token: App attestation failed.
Also, on the latest version the debug token is no longer listed in the Xcode logging when I remove predefined debug token from my activate method:
/// Activate Firebase App Check
await FirebaseAppCheck.instance.activate(
providerWeb: ReCaptchaV3Provider(kWebRecaptchaSiteKey),
providerAndroid: kDebugMode
? AndroidDebugProvider(debugToken: kAndroidDebugProviderToken)
: AndroidPlayIntegrityProvider(),
providerApple: kDebugMode
? AppleDebugProvider(debugToken: kAppleDebugProviderToken)
: AppleAppAttestWithDeviceCheckFallbackProvider(),
);
When removing the kAppleDebugProviderToken, in previous versions Xcode would list the app check token so that I could add that to the debug tokens in Firebase, on the latest version it doesn't display that, it keeps saying that it's going to use the supplied debug token.
Reproducing the issue
When pinning on the versions below it WORKS, when upgrading to latest core and app check it fails with the error listed:
firebase_analytics: 12.2.0
firebase_app_check: 0.4.2
firebase_auth: 6.3.0
firebase_core: 4.6.0
firebase_crashlytics: 5.1.0
firebase_messaging: 16.1.3
firebase_remote_config: 6.3.0
firebase_storage: ^13.1.0
Firebase Core version
4.6.0
Flutter Version
3.4.0-0.3.pre
Relevant Log Output
Flutter dependencies
Expand
Flutter dependenciessnippetAdditional context and comments
Same issue posted on StackOverflow:
https://stackoverflow.com/questions/79881432/firebase-app-check-ios-debug-token-403-app-attestation-failed-despite-correct