Confusion about the AppCheck debug token

[ZYinMD]

Edit: after seeing the replies, I finally realized that all of my original questions can be answered by one simple fact: the token is just a string stored in IndexedDB, then compared with remote server. I wouldn't have had any of these confusions if the doc had mentioned it's a non-magical string in IndexedDB, which (1) is by origin, (2) can be used in other places if you copy it over, (3) can be lost on clearing cache

Original:
I'm using appCheck + debug token + js sdk v9 + callable functions. After some trial and errors I was able to make it work as intended, but the AppCheck doc is fairly new, and I'm still confused about the debug token.

Some suggestions to the doc:

1. I realized that every time I change to a different localhost port, or same port but different computer, I'll need to get a new debug token. It'd be good if the doc mentions it.
2. I realized that the token works no matter if I'm hitting the functions in emulator or in production. This is probably obvious to you, but not to me at first, so it'd be good if the doc mentions it.

Some things I'm still confused about:

1. When I add self.FIREBASE_APPCHECK_DEBUG_TOKEN = true, the token will show in the devtools console only once , and never again on subsequent reloads. Well, what if I missed it? How do I get it again?
2. When I add the debug token in the firebase console, I was told "this token will not be revealed again, please keep a record yourself at somewhere safe". Well, in what case scenario will I need to provide it again?

[Feiyang1]

Thanks for the feedback!

1. I realized that every time I change to a different localhost port, or same port but different computer, I'll need to get a new debug token. It'd be good if the doc mentions it.

You should be able to use the same debug token for different hosts, but you have to set self.FIREBASE_APPCHECK_DEBUG_TOKEN with the actual token, like so: self.FIREBASE_APPCHECK_DEBUG_TOKEN = "MY_DEBUG_TOKEN". If you set it to true as a flag, the SDK will generate a new token for each unique host.

We can definitely improve the documentation to make it more clear. @hsubox76 Can you help with it?

1. When I add self.FIREBASE_APPCHECK_DEBUG_TOKEN = true, the token will show in the devtools console only once , and never again on subsequent reloads. Well, what if I missed it? How do I get it again?

#5512 will fix it and prints the token on subsequent reloads. At the meantime, you can find it by going to the Application tab in devtool and looking for the database firebase-app-check-database in the indexeddb. The debug token is stored there.

2. When I add the debug token in the firebase console, I was told "this token will not be revealed again, please keep a record yourself at somewhere safe". Well, in what case scenario will I need to provide it again?

For example, you can use the same token in CI, another dev machine, etc. by setting self.FIREBASE_APPCHECK_DEBUG_TOKEN with the value of that token.

[hsubox76]

Adding a link to the docs page that needs to be changed, for reference: https://firebase.google.com/docs/app-check/web/debug-provider#with-npm

[ovidiu-b]

Can you add an example on how would you do it if you are using a framework like Nuxt.js? I cannot add <script>self.FIREBASE_APPCHECK_DEBUG_TOKEN = true;</script> to and .js file. I don't even know what "self" means. I think https://firebase.google.com/docs/app-check/web/debug-provider should be better documented

[ZYinMD]

I made an edit in OP.