secure_endpoint.js

const express = require('express');
const admin = require('firebase-admin');
const app = express();
admin.initializeApp();

const appCheckVerification = async (req, res, next) => {
  const appCheckToken = req.header('X-Firebase-AppCheck');
  if (!appCheckToken) {
    res.status(401);
    return next('Unauthorized');
  }

  try {
    await admin.appCheck().verifyToken(appCheckToken);
    return next();
  } catch (err) {
    res.status(401);
    return next('Unauthorized');
  }
}

app.get('/quote', [appCheckVerification], async (req, res) => {
  const data = await callExternalService();
  res.json(data);
});