Place the SDK in the architecture and understand its protection boundary.
1. Client SDK responsibility
Firebase AI Logic provides a supported client integration for model access. It does not replace your domain validation, authorization rules or product-specific evaluation.
2. Provider and project selection
Choose the supported model provider for your project and verify model availability. Keep development and production projects separate so experiments do not share production budgets and data.
3. Identity versus attestation
Authentication identifies a user; App Check attests an app or device context. Neither alone proves that a requested business action is allowed. Protected inference still needs quotas and data access controls.
Worked scenario
A signed-in user can still abuse generation. Conversely, a valid app installation may not have permission to read another user’s receipt.
Apply it
Draw how user identity, App Check and model access interact. Identify the control that limits each abuse case.
Check your understanding
You do not use App Check as a replacement for user authorization. Explain the decision and show evidence from your implementation or design. If you cannot demonstrate it yet, revisit the relevant section before continuing.