중요: 2024년 5월 1일부터 Apple에서는 GoogleSignIn-iOS와 같이 흔히 사용되는 SDK를 사용하는 iOS 애플리케이션의 개인 정보 보호 매니페스트 및 서명을 요구합니다. 2024년 5월 1일 전에 GoogleSignIn-iOS v7.1.0 이상으로 업그레이드하세요. 업그레이드 가이드를 따르세요.
번들 ID는 두 개 이상의 앱으로 해석될 수 있으므로 와일드 카드를 사용하면 안 됩니다. 즉, 번들 ID에 별표 (*) 기호가 포함되어서는 안 됩니다.
앱 체크를 사용 설정하려면 iOS 클라이언트의 수정 보기에서 Firebase 앱 체크를 사용하여 OAuth 클라이언트가 악용되지 않도록 보호 전환 버튼을 사용 설정합니다.
앱 체크를 사용 설정하면 OAuth 클라이언트의 수정 보기에서 클라이언트의 OAuth 요청과 관련된 측정항목이 표시됩니다. 앱 체크를 적용하기 전에는 인증되지 않은 소스의 요청이 차단되지 않습니다. 측정항목 모니터링 페이지의 정보를 통해 언제 시정 조치를 시작해야 하는지 확인할 수 있습니다.
iOS 앱에 App Check를 사용 설정할 때 App Check 기능과 관련된 오류가 표시될 수 있습니다. 이러한 오류를 수정하려면 다음을 시도해 보세요.
지정한 번들 ID와 팀 ID가 유효한지 확인합니다.
번들 ID에 와일드 카드를 사용하지 않는지 확인합니다.
Firebase Console
Google 로그인과 함께 앱 확인을 사용하려면 Firebase 프로젝트가 있어야 합니다.
앱에서 이미 Firebase를 사용하고 있다면 동일한 프로젝트를 사용하세요.
앱에서 Firebase가 아닌 Google 로그인을 사용하는 경우 이미 Google Cloud 프로젝트가 있습니다. Firebase Console에서 새 프로젝트를 만들 때 Google Cloud 프로젝트를 선택하여 Firebase를 추가합니다.
연결 해제된 클라이언트가 있는 경우 앱 확인 페이지의 iOS용 Google ID 섹션에 '추가 설정이 필요한 연결 해제된 OAuth 클라이언트가 n개 있습니다.'라는 메시지가 표시됩니다.
또한 App Check에서 OAuth 클라이언트를 설정한 후 일부를 삭제한 경우 '일치하는 OAuth 클라이언트가 없는 재정의가 n개 있습니다'라는 메시지가 표시됩니다. 이러한 재정의를 삭제하여 안전하게 정리할 수 있습니다.
연결이 해제된 클라이언트를 Firebase 콘솔의 OAuth 클라이언트 페이지에서 기존 앱 또는 새 앱에 연결할 수 있습니다.
2. 앱에 Google 로그인 라이브러리 추가
Xcode 프로젝트에서 Google 로그인 종속 항목을 버전 8.0.0 이상으로 설정합니다.
SPM
googlesignin-ios의 종속 항목 규칙을 버전 8.0.0 이상으로 설정합니다.
CocoaPods
Podfile을 업데이트합니다.
source 'https://github.com/CocoaPods/Specs.git'
source 'https://github.com/firebase/SpecsDev.git'
target 'YourAppName' do
use_frameworks!
pod 'GoogleSignIn','~> 8.0'
:git => 'https://github.com/google/GoogleSignIn-iOS.git'
pod 'GoogleSignInSwiftSupport' # If you use SwiftUI.
end
그런 다음 pod install을 실행하고 생성된 .xcworkspace 파일을 엽니다.
Xcode에서 App Attest 기능을 앱에 추가합니다.
프로젝트의 .entitlements 파일에서 App Attest 환경을 production으로 설정합니다.
3. 앱 체크 초기화
앱 대리자의 didFinishLaunchingWithOptions 메서드에서 GIDSignIn.sharedInstance.configure(completion:)를 호출합니다. 사용자가 인식하는 지연 시간을 최소화하려면 앱의 수명 주기에서 가능한 한 빨리 이 메서드를 호출해야 합니다.
importSwiftUIimportGoogleSignInclassAppDelegate:NSObject,UIApplicationDelegate{funcapplication(_application:UIApplication,didFinishLaunchingWithOptionslaunchOptions:[UIApplication.LaunchOptionsKey:Any]?=nil)->Bool{#iftargetEnvironment(simulator)// Configure for debugging.// See: https://developers.google.com/identity/sign-in/ios/appcheck/debug-provider#elseGIDSignIn.sharedInstance.configure{errorinifleterror{print("Error configuring `GIDSignIn` for Firebase App Check: \(error)")}}#endifreturntrue}}@mainstructYourAppNameApp:App{@UIApplicationDelegateAdaptor(AppDelegate.self)varappDelegate// ...}
다음 단계
앱에 앱 체크 라이브러리가 설치되면 업데이트된 앱을 사용자에게 배포하기 시작합니다.
업데이트된 클라이언트 앱이 Google의 인증 엔드포인트에 전송하는 모든 요청과 함께 앱 체크 토큰을 보내기 시작하지만 Firebase Console의 앱 체크 섹션에서 적용을 사용 설정할 때까지 엔드포인트에서는 토큰이 유효하지 않아도 됩니다.
측정항목 모니터링
하지만 적용을 사용 설정하기 전에 이렇게 해도 기존의 적법한 사용자가 방해를 받지 않는지 확인해야 합니다. 반면에 앱 리소스 사용이 의심스러워 보이면 적용을 더 빠르게 사용 설정하는 것이 좋습니다.
[null,null,["최종 업데이트: 2025-08-31(UTC)"],[[["\u003cp\u003eThis guide explains how to enable App Check for your iOS app to enhance security by ensuring only your app can access Google's OAuth 2.0 endpoints.\u003c/p\u003e\n"],["\u003cp\u003eApp Check utilizes App Attest to verify the authenticity of OAuth 2.0 requests originating from your app, but it doesn't use it for fraud risk analysis.\u003c/p\u003e\n"],["\u003cp\u003eBefore enabling App Check, you need to integrate Google Sign-in, set up your project in either the Google API Console or Firebase Console, and add the necessary libraries and capabilities to your Xcode project.\u003c/p\u003e\n"],["\u003cp\u003eOnce implemented, monitor App Check metrics to understand its impact on users before enabling enforcement to block unverified requests.\u003c/p\u003e\n"],["\u003cp\u003eFor debugging and testing in environments like simulators, utilize the App Check debug provider as an alternative to App Attest.\u003c/p\u003e\n"]]],[],null,["This page shows you how to enable App Check in an iOS app. When you enable App\nCheck, you help ensure that only your app can access Google's OAuth 2.0\nendpoints on behalf of your project. See an [Overview](/identity/sign-in/ios/appcheck) of this feature.\n\nApp Check uses [App Attest](https://developer.apple.com/documentation/devicecheck/establishing_your_app_s_integrity) to help verify that OAuth 2.0\nrequests are coming from your authentic app.\nApp Check does not use App Attest to [analyze fraud risk](https://developer.apple.com/documentation/devicecheck/assessing_fraud_risk).\n\nBefore you begin\n\n1. Make sure you have Xcode 12.5 or newer.\n\n2. Integrate Google Sign-in into your iOS app, using the\n [Google Sign-in library](/identity/sign-in/ios/start-integrating).\n\n1. Set up your project\n\nApp Check can be enabled in the [Google API Console](#api-console-setup)\nor in the [Firebase Console](#firebase-console-setup). It is not necessary to enable it in both\nplaces, just one is sufficient.\n\nGoogle API Console The following requirements must be met to successfully enable App Check for your iOS client:\n\n- You must specify a team ID for your iOS client.\n- You must not use a wildcard in your bundle ID since it can resolve to more than one app. This means that the bundle ID must not include the asterisk (\\*) symbol.\n\n| **Warning:** When App Check is enabled, you won't be able to edit your OAuth client bundle ID without creating a new client. Before creating your iOS client or enabling App Check, verify that you are using the correct bundle ID. Updating your bundle ID for an existing project can result in a broken experience for users of your apps if you are using the bundle ID as a redirect URI.\nTo enable App Check, turn on the **Protect your OAuth client from abuse with Firebase App Check** toggle button in the edit view of your iOS client.\n\n\nAfter enabling App Check, you will start seeing metrics related to OAuth requests from your\nclient in the edit view of the OAuth client. Requests from unverified sources won't be blocked\nuntil you [enforce App Check](#enforce-app-check). The information in the\nmetrics monitoring page can help you determine when to start enforcement.\n\n\nYou might see errors related to the App Check feature when enabling App Check for your iOS app. To\nfix these errors, try the following:\n\n- Verify that the bundle ID and team ID you specified are valid.\n- Verify that you are not using a wildcard for the bundle ID.\n\nFirebase Console\n\n1. You must have a Firebase project to use App Check with\n Google Sign-in.\n\n - If your app already uses Firebase, use the same project.\n\n - If your app uses Google Sign-in, but not Firebase, you already have a\n Google Cloud project. Add Firebase to your Google Cloud project by\n selecting it when you create a new project in the\n [Firebase console](https://console.firebase.google.com/)\n\n See also:\n [Relationship between Firebase projects and Google Cloud](https://firebase.google.com/docs/projects/learn-more#firebase-cloud-relationship)\n2. If you haven't already done so, add your iOS apps to your Firebase project\n using the [Project settings](https://console.firebase.google.com/project/_/settings/general/) page of the Firebase console.\n\n3. Register your apps to use App Check with the App Attest provider in the\n [App Check](https://console.firebase.google.com/project/_/appcheck/apps) section of the Firebase console.\n\n | **Note:** The **Token time to live** setting has no effect on the App Check tokens used with Google Sign-in. A fresh App Attest assertion is obtained prior to each interaction with Google's OAuth 2.0 endpoints.\n4. Make sure all of your project's OAuth clients are linked to an app.\n\n If you have unlinked clients, you'll see a message in the **Google Identity\n for iOS** section of the [App Check](https://console.firebase.google.com/project/_/appcheck/apps) page that says, \"You have\n \u003cvar translate=\"no\"\u003en\u003c/var\u003e unlinked OAuth clients which require additional setup.\"\n\n Additionally, if you have deleted some OAuth clients after setting them up\n in App Check, you'll see a message that says, \"You have \u003cvar translate=\"no\"\u003en\u003c/var\u003e\n overrides with no matching OAuth client\". You can safely clean up by\n deleting those overrides.\n\n You can link unlinked clients to an existing or new app on the\n [OAuth clients](https://console.firebase.google.com/project/_/appcheck/products/oauth) page of the Firebase console.\n\n2. Add the Google Sign-in library to your app\n\n1. In your Xcode project, set the Google Sign-in dependency to version\n `8.0.0` or higher :\n\n SPM\n\n Set the dependency rule of `googlesignin-ios` to version `8.0.0` or\n higher.\n\n CocoaPods\n\n Update your `Podfile`: \n\n source 'https://github.com/CocoaPods/Specs.git'\n source 'https://github.com/firebase/SpecsDev.git'\n\n target 'YourAppName' do\n use_frameworks!\n\n pod 'GoogleSignIn','~\u003e 8.0'\n :git =\u003e 'https://github.com/google/GoogleSignIn-iOS.git'\n pod 'GoogleSignInSwiftSupport' # If you use SwiftUI.\n end\n\n Then, run `pod install` and open the created `.xcworkspace` file.\n2. In Xcode, add the **App Attest** capability to your app.\n\n3. In your project's `.entitlements` file, set the App Attest environment to\n `production`.\n\n | **Note:** App Check doesn't accept tokens generated in the App Attest sandbox environment.\n\n3. Initialize App Check\n\nIn your app delegate's `didFinishLaunchingWithOptions` method, call\n`GIDSignIn.sharedInstance.configure(completion:)`. You should call this method\nas early as possible in your app's lifecycle to minimize user-perceived latency.\n**Note:** Calling `GIDSignIn.sharedInstance.configure(completion:)` configures App Check for use in production. When building your app for testing and debugging, call `GIDSignIn.sharedInstance.configureDebugProvider(withAPIKey:completion:)`. See [Use App Check with the debug provider](/identity/sign-in/ios/appcheck/debug-provider). \n\n import SwiftUI\n import GoogleSignIn\n\n class AppDelegate: NSObject, UIApplicationDelegate {\n func application(\n _ application: UIApplication,\n didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey : Any]? = nil\n ) -\u003e Bool {\n #if targetEnvironment(simulator)\n // Configure for debugging.\n // See: https://developers.google.com/identity/sign-in/ios/appcheck/debug-provider\n #else\n GIDSignIn.sharedInstance.configure { error in\n if let error {\n print(\"Error configuring `GIDSignIn` for Firebase App Check: \\(error)\")\n }\n }\n #endif\n\n return true\n }\n }\n\n @main\n struct YourAppNameApp: App {\n @UIApplicationDelegateAdaptor(AppDelegate.self) var appDelegate\n\n // ...\n }\n\nNext steps\n\nOnce the App Check library is installed in your app, start distributing the\nupdated app to your users.\n| **Note:** If you are adding App Attest to a production app with a large active user base, Apple recommends [gradually onboarding users](https://developer.apple.com/documentation/devicecheck/preparing_to_use_the_app_attest_service#3578850) to avoid encountering quota limits.\n\nThe updated client app will begin sending App Check tokens along with every\nrequest it makes to Google's authentication endpoints, but the endpoints won't\nrequire the tokens to be valid until you enable enforcement in the App Check\nsection of the Firebase console.\n\nMonitor metrics\n\nBefore you enable enforcement, however, you should make sure that doing so won't\ndisrupt your existing legitimate users. On the other hand, if you're seeing\nsuspicious use of your app resources, you might want to enable enforcement\nsooner.\n\nTo help make this decision, you can look at\n[App Check metrics for Google Sign-in](/identity/sign-in/ios/appcheck/monitor-metrics).\n\nEnable App Check enforcement\n\nWhen you understand how App Check will affect your users and you're ready to\nproceed, you can [enable App Check enforcement](/identity/sign-in/ios/appcheck/enable-enforcement).\n\nUse App Check in debug environments\n\nIf, after you have registered your app for App Check, you want to run your app\nin an environment that App Check would normally not classify as valid, such as a\nsimulator during development, or from a continuous integration (CI) environment,\nyou can create a debug build of your app that uses the App Check debug provider\ninstead of App Attest.\n\nSee [Use App Check with the debug provider](/identity/sign-in/ios/appcheck/debug-provider)."]]
