Using App Trust in Your Application

This chapter walks through enabling App Trust in the Oracle Backend with Firebase APIs console, configuring an attestation provider, and initializing the client SDK to ensure that App Trust tokens are automatically attached to requests and validated by your protected backend services.

Set Up App Trust

The Oracle Backend with Firebase APIs Console allows you to enable App Trust for a specific application using any allowed provider.

Before you begin: You need an account with the provider you’re using and a site/secret key pair from them. Each provider has its own sign-up flow:

Table 44-1 Web Provider Configuration

Attestation Providers Required Fields
hCaptcha - hcaptcha.com
  • TTL (Time to Live): App Check token expiration
  • SecretKey: Provider secret key
reCAPTCHA v3 - Google reCAPTCHA Admin Console
  • TTL (Time to Live): App Check token expiration
  • SecretKey: Provider secret key
  • Score threshold: Minimum score from the verdict
reCAPTCHA Enterprise - Google Cloud reCAPTCHA Enterprise
  • TTL (Time to Live): App Check token expiration
  • SecretKey: Provider secret key
  • Score threshold: Minimum score from the verdict
Cloudflare Turnstile - Cloudflare Turnstile
  • TTL (Time to Live): App Check token expiration
  • SecretKey: Provider secret key

About TTL

The TTL controls how long an App Trust token stays valid before the SDK has to fetch a new one. Longer TTLs mean fewer attestation calls but slower revocation if you need to roll the secret. One hour is a reasonable default.

About Score Thresholds

reCAPTCHA v3 and Enterprise return a score between 0.0 and 1.0 indicating how confident they are that the request is from a human. The threshold sets the minimum score that counts as “passing.” 0.5 is reCAPTCHA’s recommended starting point.

Console Steps for Setting Up App Trust

  1. First, register an app.

    See Also: Adding Oracle Backend with Firebase APIs to Your Apps for more information about registering your app

  2. Open the App Trust tab.

    Figure 44-1 Console: App Trust Tab

    Console: App Trust Tab

  3. Click the 3 dots under the action column and click Register Provider.

    Figure 44-2 Console: Register App Trust Provider

    Console: Register App Trust Provider

  4. Pick the attestation provider you want to set up, fill in the details, and then click Save.

    Figure 44-3 Console: Update Provider Details

    Console: Update Provider Details

    App Trust is now active on this app.

Initialize App Trust

Once App Trust is enabled for the app in the Console, you have to initialize it in your client code. If you don’t, no token gets attached to your requests and the backend rejects all of them.

Initialize App Trust right after you initialize the app, passing the site key from your attestation provider (not the secret key - that lives only on the backend).

import { initializeApp } from "fusabase/app";
import { initializeAppTrust, getToken, ReCaptchaV3Provider } from "fusabase/app-trust";

// Initialize Fusabase
const app = initializeApp({
  // your app config here
});

// Initialize App Trust
const appTrust = initializeAppTrust(app, {
  provider: new ReCaptchaV3Provider("YOUR_RECAPTCHA_SITE_KEY"),
});

// Optional: obtain an App Trust token directly
const tokenResult = await getToken(appTrust);
console.log(tokenResult.token);
import fusabase from 'fusabase-ns';
import {
  initializeAppTrust,
  getToken,
  ReCaptchaV3Provider, // or TurnstileProvider / HCaptchaProvider / ReCaptchaEnterpriseProvider
} from 'fusabase-ns/app-trust';

// Initialize Fusabase
const app = fusabase.initializeApp({
  --
});

// Initialize App Trust with a provider
const appTrust = initializeAppTrust(app, {
  provider: new ReCaptchaV3Provider('YOUR_RECAPTCHA_V3_SITE_KEY'),
});

// Optional: Obtain an App Trust token
const { token } = await getToken(appTrust);
console.log('App Trust token:', token);

Use Cases

1. Prevent Billing Fraud and Resource Abuse

Malicious actors often attempt to scrape data or overload backends by calling APIs directly using scripts or tools like Postman.

2. Protect Against Game Integrity Threats

In mobile gaming, attackers may use modified APIs (Android) or cracked apps (iOS) to bypass purchases or gain unfair advantages.

3. Prevent Data Scraping and Phishing Using App Spoofing

Attackers may spoof your app’s identity to steal user data or inject fake data.

4. Mitigate Application-Layer DDoS Attacks

5. Prevent Copycat Apps

Sometimes the threat is a copycat developer rather than a traditional attacker.