Firebase 앱 체크는 정상적인 앱 이외의 소스에서 발생하는 트래픽을 차단하여 앱에서 Google Maps Platform으로의 호출을 보호합니다. 이 작업은 reCAPTCHA Enterprise와 같은 증명 제공업체의 토큰을 확인하여 실행됩니다. 앱을 앱 체크와 통합하면 악의적인 요청을 방지하여 승인되지 않은 API 호출에 대한 요금이 청구되지 않습니다.
앱 체크가 나에게 적합한가요?
대부분의 경우 App Check가 권장되지만 다음 경우에는 App Check가 필요하지 않거나 지원되지 않습니다.
비공개 또는 실험용 앱 앱에 공개적으로 액세스할 수 없는 경우 앱 확인이 필요하지 않습니다.
앱이 서버 간으로만 사용되는 경우 앱 확인은 필요하지 않습니다. 하지만 GMP와 통신하는 서버가 모바일 앱과 같은 공개 클라이언트에서 사용되는 경우 GMP 대신 App Check를 사용하여 해당 서버를 보호하는 것이 좋습니다.
구현 단계 개요
대략적으로 앱을 앱 확인과 통합하는 단계는 다음과 같습니다.
앱에 Firebase를 추가합니다.
앱 체크 라이브러리를 추가하고 초기화합니다.
앱에 토큰 제공자를 추가합니다.
Maps JS 및 앱 체크 API를 초기화합니다.
디버깅을 사용 설정합니다.
앱 요청을 모니터링하고 시행 여부를 결정합니다.
App Check와 통합하면 Firebase 콘솔에서 백엔드 트래픽 측정항목을 확인할 수 있습니다. 이러한 측정항목은 유효한 앱 체크 토큰이 포함되었는지 여부에 따라 요청을 분류합니다. 자세한 내용은 Firebase 앱 체크 문서를 참고하세요.
대부분의 요청이 합법적인 소스에서 발생하고 사용자가 앱 체크 구현이 포함된 최신 버전의 앱으로 업데이트한 것이 확실하면 시행을 사용 설정할 수 있습니다. 적용이 사용 설정되면 앱 체크에서 유효한 앱 체크 토큰이 없는 모든 트래픽을 거부합니다.
앱 체크 통합을 계획할 때 고려사항
통합을 계획할 때 고려해야 할 사항은 다음과 같습니다.
Google에서 추천하는 증명 제공업체 중 하나인 reCAPTCHA Enterprise는 월 10,000회를 초과하는 평가에 대해 요금을 청구합니다.
Google에서 추천하는 다른 증명 제공업체인 reCAPTCHA v3에는 할당량이 있으며, 이 할당량을 초과하면 트래픽이 평가되지 않습니다.
맞춤 증명 제공업체를 사용할 수도 있지만 이는 고급 사용 사례입니다. 자세한 내용은 앱 체크 문서를 참고하세요.
앱 사용자는 시작 시 약간의 지연 시간을 경험하게 됩니다. 하지만 이후에는 주기적인 재증명이 백그라운드에서 이루어지므로 사용자에게 더 이상 지연 시간이 발생하지 않습니다. 시작 시 정확한 지연 시간은 선택한 증명 제공업체에 따라 달라집니다.
앱 체크 토큰이 유효한 시간 (수명, TTL)에 따라 재증명의 빈도가 결정됩니다. 이 기간은 Firebase Console에서 구성할 수 있습니다. 재증명은 TTL의 약 절반이 경과하면 발생합니다. 자세한 내용은 증명 제공업체의 Firebase 문서를 참고하세요.
import{initializeApp}from'firebase/app';import{getToken,initializeAppCheck,ReCaptchaEnterpriseProvider,}from'firebase/app-check';asyncfunctioninit(){const{Settings}=awaitgoogle.maps.importLibrary('core');const{Map}=awaitgoogle.maps.importLibrary('maps');constapp=initializeApp({// Your firebase configuration object});// Pass your reCAPTCHA Enterprise site key to initializeAppCheck().constappCheck=initializeAppCheck(app,{provider:newReCaptchaEnterpriseProvider('abcdefghijklmnopqrstuvwxy-1234567890abcd',),// Optional argument. If true, the SDK automatically refreshes App Check// tokens as needed.isTokenAutoRefreshEnabled:true,});Settings.getInstance().fetchAppCheckToken=()=>
getToken(appCheck,/* forceRefresh = */false);// Load a mapmap=newMap(document.getElementById("map"),{center:{lat:37.4161493,lng:-122.0812166},zoom:8,});}
5단계: 디버깅 사용 설정 (선택사항)
로컬에서 앱을 개발 및 테스트하거나 지속적 통합 (CI) 환경에서 앱을 실행하려면 디버그 비밀을 사용하여 유효한 앱 체크 토큰을 획득하는 앱의 디버그 빌드를 만들면 됩니다. 이렇게 하면 디버그 빌드에서 실제 증명 제공자를 사용하지 않아도 됩니다.
앱을 로컬에서 테스트하려면 다음 단계를 따르세요.
개발 목적으로 디버그 제공자를 활성화합니다.
SDK의 디버그 로그에서 자동으로 생성된 무작위 UUID4(_디버그 토큰_이라고도 함)를 받게 됩니다. 이 토큰을 Firebase Console에 추가합니다.
시행을 시작하기 전에 앱의 적법한 사용자를 방해하지 않는지 확인해야 합니다. 이렇게 하려면 앱 체크 측정항목 화면을 방문하여 앱 트래픽 중 인증된 트래픽, 오래된 트래픽, 불법 트래픽의 비율을 확인하세요. 대부분의 트래픽이 인증된 것으로 확인되면 시행을 사용 설정할 수 있습니다.
[null,null,["최종 업데이트: 2025-08-27(UTC)"],[[["\u003cp\u003eFirebase App Check secures your Google Maps Platform API key by verifying app requests and blocking unauthorized traffic.\u003c/p\u003e\n"],["\u003cp\u003eApp Check integrates with attestation providers like reCAPTCHA Enterprise to validate requests, protecting against malicious activity and unnecessary charges.\u003c/p\u003e\n"],["\u003cp\u003eImplementation involves adding Firebase and App Check to your app, initializing with a token provider, and enabling enforcement after monitoring request metrics.\u003c/p\u003e\n"],["\u003cp\u003eConsider potential costs associated with reCAPTCHA Enterprise and temporary latency for users during initial attestation.\u003c/p\u003e\n"],["\u003cp\u003eBefore enforcing App Check, ensure the majority of your app traffic is verified to avoid disrupting legitimate users.\u003c/p\u003e\n"]]],[],null,["Select platform: [Android](/maps/documentation/places/android-sdk/app-check \"View this page for the Android platform docs.\") [iOS](/maps/documentation/places/ios-sdk/app-check \"View this page for the iOS platform docs.\") [JavaScript](/maps/documentation/javascript/maps-app-check \"View this page for the JavaScript platform docs.\")\n\n\u003cbr /\u003e\n\nUse App Check to secure your API key\n====================================\n\n\n[Firebase App Check](https://firebase.google.com/docs/app-check) provides protection for calls from your app to Google Maps Platform by blocking traffic that comes from sources other than legitimate apps. It does this by checking for a token from an attestation provider like [reCAPTCHA Enterprise](https://cloud.google.com/recaptcha-enterprise). Integrating your apps with App Check helps to protect against malicious requests, so you're not charged for unauthorized API calls.\n\nIs App Check right for me?\n--------------------------\n\n\nApp Check is recommended in most cases, however App Check is not needed or is not supported in the following cases:\n\n- Private or experimental apps. If your app is not publicly accessible, App Check is not needed.\n- If your app is only used server-to-server, App Check is not needed. However, if the server that communicates with GMP is used by public clients (such as mobile apps), consider [using App Check to protect that server](https://firebase.google.com/docs/app-check/custom-resource-backend) instead of GMP.\n\nOverview of implementation steps\n--------------------------------\n\nAt a high level, these are the steps you'll follow to integrate your app with App Check:\n\n1. Add Firebase to your app.\n2. Add and initialize the App Check library.\n3. Add the token provider to your app.\n4. Initialize the Maps JS and App Check APIs.\n5. Enable debugging.\n6. Monitor your app requests and decide on enforcement.\n\n\nOnce you've integrated with App Check, you'll be able to see backend traffic metrics on the Firebase console. These metrics provide breakdown of requests by whether they are accompanied by a valid App Check token. See the [Firebase App Check documentation](https://firebase.google.com/docs/app-check/monitor-metrics) for more information.\n\n\nWhen you're sure that most requests are from legitimate sources and that users have updated to the latest version of your app that includes your implementation of App Check, you can turn on enforcement. Once enforcement is on, App Check will reject all traffic without a valid App Check token.\n| **Note:** App check enforcement is not turned on by default.\n\nConsiderations when planning an App Check integration\n-----------------------------------------------------\n\n\nHere are some things to consider as you plan your integration:\n\n- One of the attestation providers we recommend, [reCAPTCHA Enterprise](https://cloud.google.com/recaptcha-enterprise) charges for more than 10,000 assessments per month.\n\n The other attestation provider we recommend, [reCAPTCHA v3](/recaptcha/docs/v3) has a quota, after which traffic won't be evaluated.\n\n You can choose to use a custom attestation provider, though this is an advanced use case. See the [App Check documentation](https://firebase.google.com/docs/app-check/custom-provider) for more information.\n- Users of your app will experience some latency on startup. However, afterwards, any periodic re-attestation will occur in the background and users should no longer experience any latency. The exact amount of latency at startup depends on the attestation provider you choose.\n\n The amount of time that the App Check token is valid (the *time to live* , or TTL) determines the frequency of re-attestations. This duration can be configured in the Firebase console. Re-attestation occurs when approximately halkf of the TTL has elapsed. For more information, see the [Firebase docs](https://firebase.google.com/docs/app-check#get_started) for your attestation provider.\n\nIntegrate your app with App Check\n---------------------------------\n\n| Note: Get help faster! For support regarding the Firebase-related portions of this process, see [Firebase support](https://firebase.google.com/support). For support regarding the Google Places API, see [Google Maps Platform support](/maps/support).\n\n### Prerequisites and requirements\n\n- An app with the [the latest weekly or quarterly version of the Maps JS API](/maps/documentation/javascript/versions) and Core libraries loaded.\n- A Cloud project with the Maps JS API enabled.\n- You must be the owner of the app in Cloud Console.\n- You will need the app's project ID from the Cloud Console\n\n### Step 1: Add Firebase to your app\n\n\nFollow [the instructions in the Firebase developer documentation](https://firebase.google.com/docs/web/setup) to add Firebase to your app.\n\n\n### Step 2: Add the App Check library and initialize App Check\n\nFirebase provides instructions for each default attestation provider. These instructions show you how to set up a Firebase project and add the App Check library to your app. Follow the code samples provided to initialize App Check.\n\n- [Instructions for reCAPTCHA Enterprise](https://firebase.google.com/docs/app-check/web/recaptcha-enterprise-provider).\n- [Instructions for reCAPTCHA v3](https://firebase.google.com/docs/app-check/web/recaptcha-provider).\n\n | You must register your site for reCAPTCHA v3 and get your reCAPTCHA v3 site key and secret key using the reCAPTCHA site registration tool before you enable the API on the Cloud Console. See the [reCAPTCHA v3 documentation](/recaptcha/intro) for more information and instructions.\n\n### Step 3: Load Maps JS API libraries\n\n1. Load the core and Maps libraries as shown in the following snippet. For more information and instructions, see the [Maps JavaScript API documentation](/maps/documentation/javascript/load-maps-js-api).\n\n ```javascript\n async function init() {\n const {Settings} = await google.maps.importLibrary('core');\n const {Map} = await google.maps.importLibrary('maps');\n } \n ```\n\n### Step 4: Initialize the Maps and App Check APIs\n\n1. Initialize App Check using the config provided by the Firebase console.\n - [reCAPTCHA v3 instructions](https://firebase.google.com/docs/app-check/web/recaptcha-provider).\n - [reCAPTCHA Enterprise instructions.](https://firebase.google.com/docs/app-check/web/recaptcha-enterprise-provider)\n2. Ensure that requests to the Maps JS API are accompanied by App Check tokens: \n\n ```javascript\n import {initializeApp} from 'firebase/app';\n import {\n getToken,\n initializeAppCheck,\n ReCaptchaEnterpriseProvider,\n } from 'firebase/app-check';\n \n async function init() {\n const {Settings} = await google.maps.importLibrary('core');\n const {Map} = await google.maps.importLibrary('maps');\n \n const app = initializeApp({\n // Your firebase configuration object\n });\n \n // Pass your reCAPTCHA Enterprise site key to initializeAppCheck().\n const appCheck = initializeAppCheck(app, {\n provider: new ReCaptchaEnterpriseProvider(\n 'abcdefghijklmnopqrstuvwxy-1234567890abcd',\n ),\n \n // Optional argument. If true, the SDK automatically refreshes App Check\n // tokens as needed.\n isTokenAutoRefreshEnabled: true,\n });\n \n Settings.getInstance().fetchAppCheckToken = () =\u003e\n getToken(appCheck, /* forceRefresh = */ false);\n \n // Load a map\n map = new Map(document.getElementById(\"map\"), {\n center: { lat: 37.4161493, lng: -122.0812166 },\n zoom: 8,\n });\n } \n \n ```\n\n### Step 5: Enable debugging (optional)\n\nIf you'd like to develop and test your app locally, or run it in a continuous integration (CI) environment, you can create a debug build of your app that uses a debug secret to obtain valid App Check tokens. This lets you avoid using real attestation providers in your debug build.\n\nTo test your app locally:\n\n- Activate the debug provider for development purposes.\n- You will receive an automatically generated random UUID4 (called the _debug token_ in the App Check documentation) from the SDK's debug logs. Add this token to the Firebase console.\n- For more information and instructions, see the [App Check documentation](https://firebase.google.com/docs/app-check/web/debug-provider#localhost).\n\nTo run your app in a CI environment:\n\n- Generate a random UUID4 from the Firebase console.\n- Add the UUID4 as a debug token, and then copy it into a secret store that the CI tests will access per test run.\n- For more information and instructions, see the [App Check documentation](https://firebase.google.com/docs/app-check/web/debug-provider#ci).\n\n### Step 6: Monitor your app requests and decide on enforcement\n\n\nBefore you begin enforcement, you'll want to make sure that you won't disrupt legitimate users of your app. To do this, visit the App Check metrics screen to see what percentage of your app's traffic is verified, outdated, or illegitimate. Once you see that the majority of your traffic is verified, you can enable enforcement.\n\n\nSee the [Firebase App Check documentation](https://firebase.google.com/docs/app-check/monitor-metrics) for more information and instructions.\n| Before you enforce App Check, make sure any Web Service calls in your Cloud project use [OAuth](/maps/documentation/places/web-service/oauth-token)."]]
