firebaseandroidgeminisecuritytutorials

Enforce App Check for Gemini 4 Argon on Android

Step-by-step guide to enforce Firebase App Check for Gemini 4 Argon in Android apps before the November 2026 deadline.

November 9, 2026 Yum News

Firebase requires App Check enforcement for Firebase AI Logic starting November 2, 2026. Without a valid token, calls to Gemini 4 Argon from your Android app will fail.

This guide shows how to enforce App Check, set up the debug provider for local testing, and call the model securely.

Why App Check matters for Gemini 4 Argon

Firebase AI Logic lets your Android app call Gemini models directly. Gemini 4 Argon is available on the paid tier. Direct client calls expose the API to abuse if anyone extracts credentials.

App Check verifies that requests come from your authentic app on an untampered device. When enforced, unverified requests are blocked. New guided setups since early July 2026 enforce it automatically. Older projects must enable it manually.

You can delay auto-enforcement until January 21, 2027, but production apps need a real attestation provider before then.

Check and enforce App Check

Open the Firebase console and go to Security > App Check > APIs tab.
Find the Firebase AI Logic row. If it shows Unenforced, click the row.
Select Set up. Choose Enforced for baseline protection. Leave replay protection disabled for the initial setup.
Confirm and finish.

After enforcement, only requests with a valid App Check token succeed.

Set up the debug provider for development

Emulators and debug builds cannot pass Play Integrity attestation. Use the debug provider while App Check remains enforced.

Add the dependency in your app-level build.gradle.kts:

implementation("com.google.firebase:firebase-appcheck-debug")

In your debug Application or MainActivity (before other Firebase use):

Firebase.initialize(context = this)
Firebase.appCheck.installAppCheckProviderFactory(
    DebugAppCheckProviderFactory.getInstance()
)

Run the app. Check Logcat for the debug token line. Copy the UUID. In the Firebase console, go to App Check > Apps, select your Android app, open Manage debug tokens, and register the token.

Local calls now succeed. Remove the debug factory from release builds.

Switch to Play Integrity for production

For released apps, use the Play Integrity provider.

Add the dependency:

implementation("com.google.firebase:firebase-appcheck-playintegrity")

Initialize it instead of the debug factory:

Firebase.appCheck.installAppCheckProviderFactory(
    PlayIntegrityAppCheckProviderFactory.getInstance()
)

Register your app in the App Check Apps tab with the Play Integrity provider. Provide the SHA-256 certificate fingerprint from your Play Console or signing key. Enable the Play Integrity API in Google Cloud if prompted.

Users on older app versions without App Check will be blocked after the deadline. Ship an update that includes the provider before January 2027 if you delay enforcement.

Call Gemini 4 Argon

With App Check active, initialize the model:

val model = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel("gemini-4-argon")

val response = model.generateContent("Explain the latest Android security features.")
println(response.text)

Gemini 4 Argon requires billing. Confirm your project has the Gemini Developer API enabled and a payment method attached. Monitor usage in the Google Cloud console.

For more on adding the model, see the guide on adding Gemini 4 Argon to Android with Firebase AI Logic.

Tips for a smooth rollout

Test with the debug provider first. Confirm the token appears in logs and is registered. Then switch to Play Integrity on a signed release build installed from Play.

Set budget alerts. Argon is a frontier model and consumes more tokens on complex prompts.

If you have live users on older builds, delay enforcement temporarily via the date picker on the App Check APIs tab (maximum January 21, 2027). Push the App Check update and encourage upgrades.

Replay protection (one-time tokens) adds stronger protection. Enable it after basic enforcement works.

Conclusion

Enforcing App Check before the November 2026 deadline keeps Gemini 4 Argon calls working and protects your quota. Start with the debug provider for development, move to Play Integrity for production, and verify end-to-end before the cutoff.