[DropMatch]

The App Check section in firebase-basics/references/android_setup.md (and the same snippet in firebase-ai-logic-basics/references/usage_patterns_android.md) says this line pins the debug token for normal emulator runs:

manifestPlaceholders["firebaseAppCheckDebugSecret"] = appCheckDebugToken

As far as I can tell, nothing in App Check reads that value:

• DebugAppCheckProvider uses an InternalDebugSecretProvider if one is registered, otherwise a UUID it generates once and keeps in SharedPreferences (source).
• The only InternalDebugSecretProvider is DebugSecretProvider in firebase-appcheck-debug-testing, and it reads InstrumentationRegistry.getArguments() (source).
• No App Check code reads manifest meta-data, and a placeholder does nothing unless the manifest uses it.

So a normal debug launch still gets a new token per install, and an agent following the skill will believe the token is pinned when it isn't. The testInstrumentationRunnerArguments line is real, but it only works with firebase-appcheck-debug-testing, which the section never adds.

This PR:

• removes the manifestPlaceholders line and says normal debug runs get a per-install token that has to be registered for each device or emulator
• keeps the fixed token for instrumentation tests, adding the androidTestImplementation dependency and a DebugAppCheckTestHelper example (withDebugProvider<Exception>, since Kotlin can't infer the type parameter otherwise)

If a manifest-based secret for normal debug runs is meant to work, then this is an SDK gap rather than a docs one, and I'm happy to open an issue on firebase-android-sdk instead.

[gemini-code-assist]

Code Review

This pull request updates the Android App Check documentation in usage_patterns_android.md and android_setup.md to clarify how debug tokens are generated and stored, noting that manifest placeholders and BuildConfig fields do not affect normal debug runs. It also introduces instructions and code examples for using firebase-appcheck-debug-testing and DebugAppCheckTestHelper for instrumentation tests. The review feedback suggests adding the necessary import statements to the Kotlin code snippets in both files to make them fully self-contained and easier to copy-paste.

[gemini-code-assist]

To make this code snippet fully self-contained and easy to copy-paste, please include the import statement for DebugAppCheckTestHelper.

Suggested change

	DebugAppCheckTestHelper.fromInstrumentationArgs().withDebugProvider<Exception> {
	// Firebase AI Logic calls
	}
	import com.google.firebase.appcheck.debug.testing.DebugAppCheckTestHelper
	DebugAppCheckTestHelper.fromInstrumentationArgs().withDebugProvider<Exception> {
	// Firebase AI Logic calls
	}

[DropMatch]

Added in b039fed.

[gemini-code-assist]

To make this test snippet fully self-contained and easy to copy-paste, please include the import statements for DebugAppCheckTestHelper and Test.

Suggested change

	@Test
	fun readsProtectedData() {
	DebugAppCheckTestHelper.fromInstrumentationArgs().withDebugProvider<Exception> {
	// Calls to App Check-protected Firebase services
	}
	}
	import com.google.firebase.appcheck.debug.testing.DebugAppCheckTestHelper
	import org.junit.Test
	@Test
	fun readsProtectedData() {
	DebugAppCheckTestHelper.fromInstrumentationArgs().withDebugProvider<Exception> {
	// Calls to App Check-protected Firebase services
	}
	}

[DropMatch]

Added in b039fed.