For example I get 8 active users based on analytics one day and the same day I can see newly 23 authenticated users with new identifiers (I don't count returning users who got their identifiers earlier). What is the reason for that? Which value is more reliable? Are they bots? I need to mention that I enforced app check verification.
The count of signed up users from Authentication is different from Analytic's active users count. For active users, it is based on the users that have engaged with an app in the device foreground, and have logged a user_engagement event. The Active User metric is based from the reporting identity setting in your analytics setting. Here's how they work:
By User-ID and device: this method uses the more accurate User-ID if it is collected to identify a user and unify all related events in reporting and analysis. If no User-ID is collected, then Analytics uses a device ID, either the Analytics cookie for websites or the App-Instance ID for apps, to identify a user. You may apply a "signed in with User ID" filter to deduplicate those users.
By device: this method uses only the device ID, either the Analytics cookie for websites or the App-Instance ID for apps, to identify a user, and ignores any User-IDs that were collected.