Search code examples
firebasefirebase-app-check

When is the appCheck.onTokenChanged callback invoked?

I am using appcheck in my web project and setting it up like so:

const appCheck = firebase.appCheck();
appCheck.activate( "my site key", true);
appCheck.onTokenChanged((token) => {
   console.log("Token:", token);
});

Am I correct to assume that if the onTokenChanged callback is invoked then the browser has passed appcheck attestation?

If this is so then my intention is that I would enable analytics when the callback is invoked as I can be reasonably sure that it is a legitimate user not a bot.

Solution

  • When you call onTokenChanged your callback will be:

    • If the App Check token already exists, your callback is invoked immediately with that value.
    • If the App Check token doesn't exist yet, your callback will be invoked once it is generated.

    In addition:

    • Your callback will always be invoked when the App Check token is updated.

    In any of these cases, the app has passed the checks by the attestation provider.