[DropMatch]

The App Check section in firebase-basics/references/android_setup.md (and the same snippet in firebase-ai-logic-basics/references/usage_patterns_android.md) says this line pins the debug token for normal emulator runs:

manifestPlaceholders["firebaseAppCheckDebugSecret"] = appCheckDebugToken

As far as I can tell, nothing in App Check reads that value:

• DebugAppCheckProvider uses an InternalDebugSecretProvider if one is registered, otherwise a UUID it generates once and keeps in SharedPreferences (source).
• The only InternalDebugSecretProvider is DebugSecretProvider in firebase-appcheck-debug-testing, and it reads InstrumentationRegistry.getArguments() (source).
• No App Check code reads manifest meta-data, and a placeholder does nothing unless the manifest uses it.

So a normal debug launch still gets a new token per install, and an agent following the skill will believe the token is pinned when it isn't. The testInstrumentationRunnerArguments line is real, but it only works with firebase-appcheck-debug-testing, which the section never adds.

This PR:

• removes the manifestPlaceholders line and says normal debug runs get a per-install token that has to be registered for each device or emulator
• keeps the fixed token for instrumentation tests, adding the androidTestImplementation dependency and a DebugAppCheckTestHelper example (withDebugProvider<Exception>, since Kotlin can't infer the type parameter otherwise; checked that it compiles)

If a manifest-based secret for normal debug runs is meant to work, then this is an SDK gap rather than a docs one, and I'm happy to open an issue on firebase-android-sdk instead.

🤖 Generated with Claude Code

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request updates the Android documentation for Firebase App Check, clarifying how debug tokens are handled and registered. It corrects previous misconceptions about manifest placeholders and BuildConfig fields, and adds clear guidelines and code snippets for setting up instrumentation tests using firebase-appcheck-debug-testing and DebugAppCheckTestHelper. The review feedback suggests adding the necessary imports to the Kotlin code snippet for installing the debug provider to make it fully self-contained.

[gemini-code-assist]

To make the Kotlin code snippet fully self-contained and easy to copy-paste, consider including the necessary imports for Firebase, appCheck, and DebugAppCheckProviderFactory.

Suggested change

	if (BuildConfig.DEBUG) {
	Firebase.appCheck.installAppCheckProviderFactory(
	DebugAppCheckProviderFactory.getInstance()
	)
	}
	import com.google.firebase.Firebase
	import com.google.firebase.appcheck.appCheck
	import com.google.firebase.appcheck.debug.DebugAppCheckProviderFactory
	if (BuildConfig.DEBUG) {
	Firebase.appCheck.installAppCheckProviderFactory(
	DebugAppCheckProviderFactory.getInstance()
	)
	}