AppCheck on Expo iOS Development Client

[leons1767]

Hi there, I've been trying to get AppCheck working on Expo iOS Development Client build with EAS running on a physical device. The error is

`[Error: [appCheck/token-error] The operation couldn’t be completed. Too many attempts. Underlying error: The operation couldn’t be completed. The server responded with an error:

• URL: https://firebaseappcheck.googleapis.com/v1/projects/XXX/apps/X:XXX:ios:XXX:exchangeDeviceCheckToken
• HTTP status code: 400
• Response body: {
  "error": {
  "code": 400,
  "message": "App not registered: X:XXX:ios:XXX.",
  "status": "FAILED_PRECONDITION"
  }
  }`

I followed the setup instruction from the official documentation. Android is working fine, I just couldn't get it working on iOS. I have the following standard initialization codes in my App.js

useEffect(() => {

    const rnfbProvider = appCheck().newReactNativeFirebaseAppCheckProvider()
    rnfbProvider.configure({
      android: {
        provider: __DEV__ ? 'debug' : 'playIntegrity',
        debugToken: __DEV__ ? APPCHECK_ANDROID_DEBUG_TOKEN : '',
      },
      apple: {
        provider: __DEV__ ? 'debug' : 'appAttestWithDeviceCheckFallback',
        debugToken: __DEV__ ? APPCHECK_IOS_DEBUG_TOKEN : '',
      },
      web: {
        provider: 'reCaptchaV3',
        siteKey: 'unknown',
      },
    });
    appCheck().initializeAppCheck({ provider: rnfbProvider, isTokenAutoRefreshEnabled: true });
    __DEV__ && appCheckTest()
  
  },[])

const appCheckTest = async () => {
  try {
    const { token } = await appCheck().getToken(true);

    if (token.length > 0) {
      console.log('App| AppCheck verification passed', token);
    }
  } catch (error) {
    console.error('App| AppCheck verification failed', error);
  }
}

eas.json is also updated following what is advised in the official documentation.

{
  ...
  "build": {
    "development": {
      "developmentClient": true,
      "distribution": "internal",
      "env": {
        ...
        "FIREBASE_APP_CHECK_DEBUG_TOKEN": "${secrets.FIREBASE_APP_CHECK_DEBUG_TOKEN}" 
      }
    },
    ...
  },
  ...
}

It can access firestore fine, just without appCheck. I suppose the GoogleService-Info.plist is correct. Debug tokens are added for both Android and iOS app in Firebase (Android is working fine). I've also enabled AppAttest in the Apple developer provisioning profile and rebuild the development client with EAS, no luck.

Anyone can tell me what did I do wrong, or point me to the right direction? I've searched around, and couldn't find anything related to Expo iOS Development Client. Hopefully, someone with experience could help.

Many thanks in advance!

[leons1767]

Let me answer my own question. It turns out that DeviceCheck needs to be enabled in the Firebase AppCheck console even if I'm using AppAttest only. I'm not sure if this is because of Firebase or React Native Firebase. Nowhere in the documentation suggests that both must be enabled to use debug token for AppAttest.

[hernanjoseDev]

Hi, I have a question, what values ​​go in the debugToken box? And where can I find it?

[mikehardy]

The Flutter docs on device check debug tokens are reasonably applicable here https://firebase.google.com/docs/app-check/flutter/debug-provider

You can ignore the activation of the provider, react-native-firebase handles that for you. Otherwise the description of how to get the token and how to register it are correct.

[hernanjoseDev]

Hello, I am half lost regarding adding appCheck to my project, I am using react native with expo sdk 50 and although I was able to implement it as it appears in the documentation: ' https://rnfirebase.io/app-check/usage ' but I have doubts about the token, since the FIREBASE_APP_CHECK_DEBUG_TOKEN that I have added clarifies It must be private and I cannot add it to my source code in production, I don't know what token code I should put.

[mikehardy]

I don't use Expo so I can't really help. But I recall they have some way of managing secrets. Perhaps https://docs.expo.dev/build-reference/variables/

You'll need to figure out how to manage your secrets in Expo and inject them during build

[leons1767]

Use __DEV__ and pass the token only when it is true. By doing that, the debug token will be removed automatically when it is building for production.

[hernanjoseDev]

Thanks for your answers, good programming!