From 400d63ab8e41380d0e11465caacdfdbebfe16eed Mon Sep 17 00:00:00 2001
From: Austin Benoit <austinbenoit@google.com>
Date: Fri, 7 Aug 2026 01:10:19 +0000
Subject: [PATCH] chore(app_check): Update the app check debug token message
 (#16482)

---
 FirebaseAppCheck/CHANGELOG.md                 |  4 ++
 .../DebugProvider/FIRAppCheckDebugProvider.m  | 37 ++++++++++++++++---
 2 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/FirebaseAppCheck/CHANGELOG.md b/FirebaseAppCheck/CHANGELOG.md
index 7c5ff0714f..efc15025cb 100644
--- a/FirebaseAppCheck/CHANGELOG.md
+++ b/FirebaseAppCheck/CHANGELOG.md
@@ -1,3 +1,7 @@
+# Unreleased
+- [changed] Updated the App Check debug token log message to include Firebase CLI
+  registration commands and a link to the debug token guide.
+
 # 12.17.0
 - [changed] The default App Check provider for iOS physical devices no longer
   attempts to configure the reCAPTCHA provider before falling back to
diff --git a/FirebaseAppCheck/Sources/DebugProvider/FIRAppCheckDebugProvider.m b/FirebaseAppCheck/Sources/DebugProvider/FIRAppCheckDebugProvider.m
index 164250e4ad..0498b3ca8d 100644
--- a/FirebaseAppCheck/Sources/DebugProvider/FIRAppCheckDebugProvider.m
+++ b/FirebaseAppCheck/Sources/DebugProvider/FIRAppCheckDebugProvider.m
@@ -46,6 +46,8 @@ NS_ASSUME_NONNULL_BEGIN
     _debugProvider = debugProvider;
     _projectID = [projectID copy];
     _googleAppID = [googleAppID copy];
+
+    [self logDebugTokenMessageWithMessageCode:kFIRLoggerAppCheckMessageCodeDebugToken prefix:@""];
   }
   return self;
 }
@@ -83,16 +85,39 @@ NS_ASSUME_NONNULL_BEGIN
 
 #pragma mark - Private Helpers
 
-- (void)logDebugTokenExchangeError {
+- (void)logDebugTokenMessageWithMessageCode:(NSString *)messageCode prefix:(NSString *)prefix {
   if (self.projectID.length > 0 && self.googleAppID.length > 0) {
-    FIRLogWarning(kFIRLoggerAppCheck, kFIRLoggerAppCheckMessageCodeDebugTokenExchangeFailed,
-                  @"Failed to exchange debug token. If you haven't registered it, "
-                   "you can do so in the Firebase Console: "
-                   "https://console.firebase.google.com/project/%@/appcheck/apps?selectedAppId=%@",
-                  self.projectID, self.googleAppID);
+    NSString *debugToken = self.localDebugToken;
+    if (!debugToken) {
+      return;
+    }
+
+    FIRLogWarning(
+        kFIRLoggerAppCheck, messageCode,
+        @"%@"
+         "To use this token for app debugging, register it with your project.\n\n"
+         "Firebase App Check debug token: %@\n\n"
+         "You can do so in the Firebase Console: \n"
+         "https://console.firebase.google.com/project/%@/appcheck/apps?selectedAppId=%@ \n\n"
+         "Or using the Firebase CLI: \n"
+         "firebase appcheck:debugtokens:create %@ --project %@ --app %@\n\n"
+         "Note: To keep your project secure, please revoke and delete this token using the \n"
+         "Firebase Console or the CLI (`firebase appcheck:debugtokens:delete`) when you finish "
+         "debugging.\n\n"
+         "Warning: This debug token is a secret and should not be shared or uploaded to source "
+         "code.\n\n"
+         "Debug Token Guide: https://firebase.google.com/docs/app-check/ios/debug-provider\n"
+         "Firebase CLI install instructions: https://firebase.google.com/docs/cli\n",
+        prefix, debugToken, self.projectID, self.googleAppID, debugToken, self.projectID,
+        self.googleAppID);
   }
 }
 
+- (void)logDebugTokenExchangeError {
+  [self logDebugTokenMessageWithMessageCode:kFIRLoggerAppCheckMessageCodeDebugTokenExchangeFailed
+                                     prefix:@"Failed to exchange debug token. "];
+}
+
 #pragma mark - FIRAppCheckProvider
 
 - (void)getTokenWithCompletion:(void (^)(FIRAppCheckToken *_Nullable token,