This PR adds support for the limitedUse parameter in thecreateToken() API of the App Check module. This allows users to generate tokens with replay protection, suitable for one-time use or session-based contexts.

RELEASE_NOTE: Added support for creating limited use App Check tokens in thecreateToken() API

feat(appcheck): Add support for minting limited use tokens

f142d51

lahirumaramba requested review fromjonathanedey andweixifan

November 28, 2025 23:07

lahirumaramba added release-note release:stageStage a release candidate labels

Nov 28, 2025

Copy link

gemini-code-assistbot commentedNov 28, 2025

Summary of Changes

Hello@lahirumaramba, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the App Check module by enabling the creation of limited use tokens. This feature provides developers with the ability to generate tokens that offer replay protection, making them ideal for securing one-time operations or session-specific interactions within applications.

Highlights

Feature Addition: Introduced support for thelimitedUse parameter in thecreateToken() API of the App Check module.
Replay Protection: This new parameter allows users to generate tokens with replay protection, suitable for one-time or session-based contexts.
API Updates: TheAppCheckTokenOptions interface was updated to include thelimitedUse property, and internal API calls were modified to pass this option.
Testing: New integration and unit tests have been added to ensure the correct functionality of limited use tokens.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on ourdocumentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either/gemini <command> or@gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a.gemini/ folder in the base of the repository. Detailed instructions can be foundhere.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on@gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign uphere.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with theGemini Code Assist IDE Extension.

Footnotes

Review thePrivacy Notices,Generative AI Prohibited Use Policy,Terms of Service, and learn how to configure Gemini Code Assist in GitHubhere. Gemini can make mistakes, so double check it anduse code with caution.↩

gemini-code-assistbot reviewed

Nov 28, 2025

View reviewed changes

Copy link

gemini-code-assistbot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Code Review

This pull request introduces support for creating limited-use App Check tokens by adding alimitedUse parameter to thecreateToken() API. The changes are well-implemented across the API, client, and internal methods, and are accompanied by thorough unit and integration tests. My review includes one suggestion to enhance input validation for the newlimitedUse parameter to improve robustness and provide clearer feedback to developers on invalid usage.

src/app-check/app-check-api-client-internal.ts

Comment on lines +61 to +65

		publicexchangeToken(
		customToken:string,
		appId:string,
		limitedUse?:boolean
		):Promise<AppCheckToken>{

Copy link

gemini-code-assistbotNov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

For improved robustness and a better developer experience, it would be beneficial to add input validation for thelimitedUse parameter. This ensures that if a value is provided, it must be a boolean. This is consistent with how other parameters likeappId andcustomToken are validated within this method, and it provides clearer error messages to developers for invalid inputs.

You can add the following check at the beginning of the function body:

if(typeoflimitedUse!=='undefined'&&!validator.isBoolean(limitedUse)){thrownewFirebaseAppCheckError('invalid-argument','`limitedUse` must be a boolean value.');}