Enforcing Firebase App Check on Cloud Run Endpoints Without SDK Wrappers

1 Aug 2026Cloud Run, App Check

When deploying standalone containers on Cloud Run, you can verify incoming Firebase App Check JWTs at the Envoy ingress layer or inside Express/Fastify middleware by verifying the token against Google's public JWKS (https://firebaseappcheck.googleapis.com/v1/jwks).

This rejects synthetic bot ingress with HTTP 401 Unauthorized before your Node.js application ever instantiates a Gemini API request, saving 100 percent of token burn from unauthenticated traffic.

appCheckMiddleware.ts

import { createRemoteJWKSet, jwtVerify } from "jose";

const JWKS = createRemoteJWKSet(new URL("https://firebaseappcheck.googleapis.com/v1/jwks"));

export async function verifyAppCheck(req, reply) {
  const token = req.headers["x-firebase-appcheck"];
  if (!token) {
    return reply.status(401).send({ error: "Missing App Check token." });
  }
  try {
    await jwtVerify(token, JWKS, {
      issuer: "https://firebaseappcheck.googleapis.com/v1",
      audience: `projects/${process.env.GCP_PROJECT_NUMBER}`,
    });
  } catch (err) {
    return reply.status(401).send({ error: "Invalid App Check verification." });
  }
}

All 7 notes