Firebase 앱 체크는 정상적인 앱 이외의 소스에서 발생하는 트래픽을 차단하여 앱에서 Google Maps Platform으로의 호출을 보호합니다. Play Integrity와 같은 증명 제공업체의 토큰을 확인하여 이를 수행합니다. 앱을 앱 체크와 통합하면 악의적인 요청을 방지하여 승인되지 않은 API 호출에 대한 요금이 청구되지 않습니다.
앱 체크가 나에게 적합한가요?
대부분의 경우 App Check가 권장되지만 다음 경우에는 App Check가 필요하지 않거나 지원되지 않습니다.
원본 Places SDK를 사용하고 있습니다. App Check는 Places SDK (신규)에서만 지원됩니다.
비공개 또는 실험용 앱 앱에 공개적으로 액세스할 수 없는 경우 앱 확인이 필요하지 않습니다.
앱이 서버 간으로만 사용되는 경우 앱 확인은 필요하지 않습니다. 하지만 GMP와 통신하는 서버가 모바일 앱과 같은 공개 클라이언트에서 사용되는 경우 GMP 대신 App Check를 사용하여 해당 서버를 보호하는 것이 좋습니다.
앱 체크의 권장 증명 제공자는 증명 제공자가 보안이 취약하거나 신뢰할 수 없는 것으로 간주하는 기기에서는 작동하지 않습니다. 이러한 기기를 지원해야 하는 경우 맞춤 증명 서비스를 배포하면 됩니다. 자세한 내용은 안내를 참고하세요.
구현 단계 개요
대략적으로 앱을 앱 확인과 통합하는 단계는 다음과 같습니다.
앱에 Firebase를 추가합니다.
앱 체크 라이브러리를 추가하고 초기화합니다.
토큰 제공업체를 추가합니다.
디버깅을 사용 설정합니다.
앱 요청을 모니터링하고 시행 여부를 결정합니다.
App Check와 통합하면 Firebase 콘솔에서 백엔드 트래픽 측정항목을 확인할 수 있습니다. 이러한 측정항목은 유효한 앱 체크 토큰이 포함되었는지 여부에 따라 요청을 분류합니다. 자세한 내용은 Firebase 앱 체크 문서를 참고하세요.
대부분의 요청이 합법적인 소스에서 발생하고 사용자가 앱 체크 구현이 포함된 최신 버전의 앱으로 업데이트한 것이 확실하면 시행을 사용 설정할 수 있습니다. 적용이 사용 설정되면 앱 체크에서 유효한 앱 체크 토큰이 없는 모든 트래픽을 거부합니다.
앱 체크 통합을 계획할 때 고려사항
통합을 계획할 때 고려해야 할 사항은 다음과 같습니다.
Google에서 권장하는 증명 제공업체인 Play Integrity에는 표준 API 사용 등급의 일일 호출 한도가 있습니다.
호출 한도에 관한 자세한 내용은 Google Play Integrity 개발자 문서의 설정 페이지를 참고하세요.
맞춤 증명 제공업체를 사용할 수도 있지만 이는 고급 사용 사례입니다. 자세한 내용은 맞춤 앱 체크 제공자 구현을 참고하세요.
앱 사용자는 시작 시 약간의 지연 시간을 경험하게 됩니다. 하지만 이후에는 주기적인 재증명이 백그라운드에서 이루어지므로 사용자에게 더 이상 지연 시간이 발생하지 않습니다. 시작 시 정확한 지연 시간은 선택한 증명 제공업체에 따라 달라집니다.
앱 체크 토큰이 유효한 시간 (수명, TTL)에 따라 재증명의 빈도가 결정됩니다. 이 기간은 Firebase Console에서 구성할 수 있습니다. 재증명은 TTL의 약 절반이 경과하면 발생합니다. 자세한 내용은 증명 제공업체의 Firebase 문서를 참고하세요.
시행을 시작하기 전에 앱의 적법한 사용자를 방해하지 않는지 확인해야 합니다. 이렇게 하려면 앱 체크 측정항목 화면을 방문하여 앱 트래픽 중 인증된 트래픽, 오래된 트래픽, 불법 트래픽의 비율을 확인하세요. 대부분의 트래픽이 인증된 것으로 확인되면 시행을 사용 설정할 수 있습니다.
[null,null,["최종 업데이트: 2025-08-30(UTC)"],[[["\u003cp\u003eFirebase App Check protects your Google Maps Platform API key by verifying requests and blocking unauthorized traffic.\u003c/p\u003e\n"],["\u003cp\u003eApp Check is recommended for most apps using Places SDK (New) but is not needed for server-to-server apps, private apps, or those using the original Places SDK.\u003c/p\u003e\n"],["\u003cp\u003eIntegrating App Check involves adding Firebase, initializing the library and a token provider, enabling debugging (optional), and monitoring requests before enforcing token validation.\u003c/p\u003e\n"],["\u003cp\u003ePlay Integrity is the recommended attestation provider; consider daily call limits and latency during initial token fetch.\u003c/p\u003e\n"],["\u003cp\u003eBefore enforcing App Check, ensure most requests are verified using the Firebase console metrics and ensure web service calls in your cloud project use OAuth.\u003c/p\u003e\n"]]],["App Check protects Google Maps Platform API keys by verifying requests originate from legitimate apps. Implementation involves: adding Firebase and the App Check library, initializing App Check, adding a token provider, optionally enabling debugging for testing, and monitoring app request metrics before enabling enforcement. App Check is not needed for the original Places SDK, private apps, or server-to-server communication. Play Integrity is the recommended attestation provider. Enforcement blocks requests without valid tokens.\n"],null,["Select platform: [Android](/maps/documentation/places/android-sdk/app-check \"View this page for the Android platform docs.\") [iOS](/maps/documentation/places/ios-sdk/app-check \"View this page for the iOS platform docs.\") [JavaScript](/maps/documentation/javascript/maps-app-check \"View this page for the JavaScript platform docs.\")\n\n\u003cbr /\u003e\n\nUse App Check to secure your API key\n====================================\n\n\n[Firebase App Check](https://firebase.google.com/docs/app-check) provides protection for calls from your app to Google Maps Platform by blocking traffic that comes from sources other than legitimate apps. It does this by checking for a token from an attestation provider like [Play Integrity](https://developer.android.com/google/play/integrity). Integrating your apps with App Check helps to protect against malicious requests, so you're not charged for unauthorized API calls.\n\nIs App Check right for me?\n--------------------------\n\n\nApp Check is recommended in most cases, however App Check is not needed or is not supported in the following cases:\n\n- You are using the original Places SDK. **App Check is only supported for Places SDK (New)**.\n- Private or experimental apps. If your app is not publicly accessible, App Check is not needed.\n- If your app is only used server-to-server, App Check is not needed. However, if the server that communicates with GMP is used by public clients (such as mobile apps), consider [using App Check to protect that server](https://firebase.google.com/docs/app-check/custom-resource-backend) instead of GMP.\n- App Check's recommended attestation providers won't work on devices deemed compromised or untrustworthy by your attestation provider. If you need to support such devices, you can deploy a custom attestation service. For more information, see the [instructions](https://firebase.google.com/docs/app-check/android/custom-resource).\n\nOverview of implementation steps\n--------------------------------\n\nAt a high level, these are the steps you'll follow to integrate your app with App Check:\n\n1. Add Firebase to your app.\n2. Add and initialize the App Check library.\n3. Add the token provider.\n4. Enable debugging.\n5. Monitor your app requests and decide on enforcement.\n\n\nOnce you've integrated with App Check, you'll be able to see backend traffic metrics on the Firebase console. These metrics provide breakdown of requests by whether they are accompanied by a valid App Check token. See the [Firebase App Check documentation](https://firebase.google.com/docs/app-check/monitor-metrics) for more information.\n\n\nWhen you're sure that most requests are from legitimate sources and that users have updated to the latest version of your app that includes your implementation of App Check, you can turn on enforcement. Once enforcement is on, App Check will reject all traffic without a valid App Check token.\n| **Note:** App check enforcement is not turned on by default.\n\nConsiderations when planning an App Check integration\n-----------------------------------------------------\n\n\nHere are some things to consider as you plan your integration:\n\n- The attestation provider we recommend, [Play Integrity](https://developer.android.com/google/play/integrity), has a daily call limit for its Standard API usage tier.\n For more information about call limits, see the [Setup](https://developer.android.com/google/play/integrity/setup#increase-daily) page in the Google Play Integrity developer documentation.\n\n You can also choose to use a custom attestation provider, though this is an advanced use case. For more information, see [Implement a custom App Check provider](https://firebase.google.com/docs/app-check/custom-provider).\n- Users of your app will experience some latency on startup. However, afterwards, any periodic re-attestation will occur in the background and users should no longer experience any latency. The exact amount of latency at startup depends on the attestation provider you choose.\n\n The amount of time that the App Check token is valid (the *time to live* , or TTL) determines the frequency of re-attestations. This duration can be configured in the Firebase console. Re-attestation occurs when approximately halkf of the TTL has elapsed. For more information, see the [Firebase docs](https://firebase.google.com/docs/app-check#get_started) for your attestation provider.\n\nIntegrate your app with App Check\n---------------------------------\n\n| Note: Get help faster! For support regarding the Firebase-related portions of this process, see [Firebase support](https://firebase.google.com/support). For support regarding the Google Places SDK for Android, see [Google Maps Platform support](/maps/support).\n\n### Prerequisites and requirements\n\n- An app with the version 4.1 or later Places SDK integrated.\n- The SHA-256 fingerprint for your app.\n- Your app's package name.\n- You must be the owner of the app in Cloud Console.\n- You will need the app's project ID from the Cloud Console\n\n### Step 1: Add Firebase to your app\n\n\nFollow [the instructions in the Firebase developer documentation](https://firebase.google.com/docs/android/setup) to add Firebase to your app.\n\n### Step 2: Add the App Check library and initialize App Check\n\nFor information on using Play Integrity, the default attestation provider, see [Get started using App Check with Play Integrity on Android](https://firebase.google.com/docs/app-check/android/play-integrity-provider).\n\n1. If you haven't already, [integrate the Places SDK into your app](/maps/documentation/places/android-sdk/config#places-sdk-for-android).\n2. Next, initialize [App Check](https://firebase.google.com/docs/app-check/android/play-integrity-provider#initialize) and the [Places client](/maps/documentation/places/android-sdk/config#connect-client).\n\n ```java\n // Initialize App Check\n FirebaseApp.initializeApp(/* context= */ this);\n FirebaseAppCheck firebaseAppCheck = FirebaseAppCheck.getInstance();\n firebaseAppCheck.installAppCheckProviderFactory(\n PlayIntegrityAppCheckProviderFactory.getInstance());\n \n // Initialize Places SDK\n Places.initializeWithNewPlacesApiEnabled(context, API_KEY);\n PlacesClient client = Places.createClient(context);.\n ```\n\n### Step 3: Add the token provider\n\n\nAfter initializing the Places API, call `setPlacesAppCheckTokenProvider()` to set the `PlacesAppCheckTokenProvider`. \n\n```java\nPlaces.initializeWithNewPlacesApiEnabled(context, API_KEY);\nPlaces.setPlacesAppCheckTokenProvider(new TokenProvider());\nPlacesClient client = Places.createClient(context);.\n```\n\n\nHere is a sample implementation of the token fetcher interface: \n\n```java\n /** Sample client implementation of App Check token fetcher interface. */\n static class TokenProvider implements PlacesAppCheckTokenProvider {\n @Override\n public ListenableFuture\u003cString\u003e fetchAppCheckToken() {\n SettableFuture\u003cString\u003e future = SettableFuture.create();\n FirebaseAppCheck.getInstance()\n .getAppCheckToken(false)\n .addOnSuccessListener(\n appCheckToken -\u003e {\n future.set(appCheckToken.getToken());\n })\n .addOnFailureListener(\n ex -\u003e {\n future.setException(ex);\n });\n\n return future;\n }\n }\n```\n\n### Step 4: Enable debugging (optional)\n\nIf you'd like to develop and test your app locally, or run it in a continuous integration (CI) environment, you can create a debug build of your app that uses a debug secret to obtain valid App Check tokens. This lets you avoid using real attestation providers in your debug build.\n\nTo run your app in an emulator or on a test device:\n\n- Add the App Check library to your `build.gradle` file.\n- Configure App Check to use the debug provider factory in your debug build.\n- Launch the app, which will create a local debug token. Add this token to the Firebase console.\n- For more information and instructions, see the [App Check documentation](https://firebase.google.com/docs/app-check/android/debug-provider#emulator).\n\n\nTo run your app in a CI environment:\n\n- Create a debug token in the Firebase console and add it to your CI system's secure key store.\n- Add the App Check library to your `build.gradle` file.\n- Configure your CI build variant to use the debug token.\n- Wrap code in your test classes that needs an App Check toke with `DebugAppCheckTestHelper`.\n- For more information and instructions, see the [App Check documentation](https://firebase.google.com/docs/app-check/android/debug-provider#ci).\n\n### Step 5: Monitor your app requests and decide on enforcement\n\n\nBefore you begin enforcement, you'll want to make sure that you won't disrupt legitimate users of your app. To do this, visit the App Check metrics screen to see what percentage of your app's traffic is verified, outdated, or illegitimate. Once you see that the majority of your traffic is verified, you can enable enforcement.\n\n\nSee the [Firebase App Check documentation](https://firebase.google.com/docs/app-check/monitor-metrics) for more information and instructions.\n| Before you enforce App Check, make sure any Web Service calls in your Cloud project use [OAuth](/maps/documentation/places/web-service/oauth-token)."]]
