Firebase App Check roles and permissions

This page lists the IAM roles and permissions for Firebase App Check. To search through all roles and permissions, see the role and permission index.

Firebase App Check roles

Role	Permissions
Firebase App Check Admin (roles/firebaseappcheck.admin) Full management of Firebase App Check.	firebaseappcheck.* firebaseappcheck.appAttestConfig.get firebaseappcheck.appAttestConfig.update firebaseappcheck.appCheckTokens.verify firebaseappcheck.automations.create firebaseappcheck.automations.delete firebaseappcheck.automations.get firebaseappcheck.automations.list firebaseappcheck.automations.resume firebaseappcheck.automations.suspend firebaseappcheck.automations.update firebaseappcheck.debugTokens.get firebaseappcheck.debugTokens.update firebaseappcheck.deviceCheckConfig.get firebaseappcheck.deviceCheckConfig.update firebaseappcheck.playIntegrityConfig.get firebaseappcheck.playIntegrityConfig.update firebaseappcheck.recaptchaEnterpriseConfig.get firebaseappcheck.recaptchaEnterpriseConfig.update firebaseappcheck.recaptchaV3Config.get firebaseappcheck.recaptchaV3Config.update firebaseappcheck.resourcePolicies.get firebaseappcheck.resourcePolicies.update firebaseappcheck.safetyNetConfig.get firebaseappcheck.safetyNetConfig.update firebaseappcheck.services.get firebaseappcheck.services.update
Firebase App Check Viewer (roles/firebaseappcheck.viewer) Read-only access for Firebase App Check.	firebaseappcheck.appAttestConfig.get firebaseappcheck.automations.get firebaseappcheck.automations.list firebaseappcheck.debugTokens.get firebaseappcheck.deviceCheckConfig.get firebaseappcheck.playIntegrityConfig.get firebaseappcheck.recaptchaEnterpriseConfig.get firebaseappcheck.recaptchaV3Config.get firebaseappcheck.resourcePolicies.get firebaseappcheck.safetyNetConfig.get firebaseappcheck.services.get
Firebase App Check Token Verifier (roles/firebaseappcheck.tokenVerifier) Access to token verification capabilities for Firebase App Check.	firebaseappcheck.appCheckTokens.verify

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
Firebase App Check Service Agent (roles/firebaseappcheck.serviceAgent) Grants Firebase App Check Service Account access to consumer app attestation resources, such as reCAPTCHA Enterprise and Play Integrity API. Warning: Do not grant service agent roles to any principals except service agents.	recaptchaenterprise.assessments.* recaptchaenterprise.assessments.annotate recaptchaenterprise.assessments.create serviceusage.services.use

Firebase App Check permissions

Permission	Included in roles
firebaseappcheck.appAttestConfig.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Firebase Admin (roles/firebase.admin) Firebase Editor (roles/firebase.editor) Firebase Viewer (roles/firebase.viewer) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase App Check Viewer (roles/firebaseappcheck.viewer) Firebase Develop Admin (roles/firebase.developAdmin) Firebase Develop Viewer (roles/firebase.developViewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.appAttestConfig.update	Owner (roles/owner) Editor (roles/editor) Firebase Admin (roles/firebase.admin) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase Develop Admin (roles/firebase.developAdmin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.appCheckTokens.verify	Firebase Admin (roles/firebase.admin) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase Develop Admin (roles/firebase.developAdmin) Firebase App Check Token Verifier (roles/firebaseappcheck.tokenVerifier) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.automations.create	Owner (roles/owner) Editor (roles/editor) Firebase Admin (roles/firebase.admin) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase Develop Admin (roles/firebase.developAdmin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.automations.delete	Owner (roles/owner) Editor (roles/editor) Firebase Admin (roles/firebase.admin) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase Develop Admin (roles/firebase.developAdmin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.automations.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Firebase Admin (roles/firebase.admin) Firebase Editor (roles/firebase.editor) Firebase Viewer (roles/firebase.viewer) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase App Check Viewer (roles/firebaseappcheck.viewer) Firebase Develop Admin (roles/firebase.developAdmin) Firebase Develop Viewer (roles/firebase.developViewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.automations.list	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Firebase Admin (roles/firebase.admin) Firebase Editor (roles/firebase.editor) Firebase Viewer (roles/firebase.viewer) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase App Check Viewer (roles/firebaseappcheck.viewer) Security Admin (roles/iam.securityAdmin) Security Reviewer (roles/iam.securityReviewer) Firebase Develop Admin (roles/firebase.developAdmin) Firebase Develop Viewer (roles/firebase.developViewer) Security Auditor (roles/iam.securityAuditor) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.automations.resume	Owner (roles/owner) Editor (roles/editor) Firebase Admin (roles/firebase.admin) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase Develop Admin (roles/firebase.developAdmin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.automations.suspend	Owner (roles/owner) Editor (roles/editor) Firebase Admin (roles/firebase.admin) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase Develop Admin (roles/firebase.developAdmin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.automations.update	Owner (roles/owner) Editor (roles/editor) Firebase Admin (roles/firebase.admin) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase Develop Admin (roles/firebase.developAdmin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.debugTokens.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Firebase Admin (roles/firebase.admin) Firebase Editor (roles/firebase.editor) Firebase Viewer (roles/firebase.viewer) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase App Check Viewer (roles/firebaseappcheck.viewer) Firebase Develop Admin (roles/firebase.developAdmin) Firebase Develop Viewer (roles/firebase.developViewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.debugTokens.update	Owner (roles/owner) Editor (roles/editor) Firebase Admin (roles/firebase.admin) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase Develop Admin (roles/firebase.developAdmin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.deviceCheckConfig.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Firebase Admin (roles/firebase.admin) Firebase Editor (roles/firebase.editor) Firebase Viewer (roles/firebase.viewer) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase App Check Viewer (roles/firebaseappcheck.viewer) Firebase Develop Admin (roles/firebase.developAdmin) Firebase Develop Viewer (roles/firebase.developViewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.deviceCheckConfig.update	Owner (roles/owner) Editor (roles/editor) Firebase Admin (roles/firebase.admin) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase Develop Admin (roles/firebase.developAdmin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.playIntegrityConfig.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Firebase Admin (roles/firebase.admin) Firebase Editor (roles/firebase.editor) Firebase Viewer (roles/firebase.viewer) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase App Check Viewer (roles/firebaseappcheck.viewer) Firebase Develop Admin (roles/firebase.developAdmin) Firebase Develop Viewer (roles/firebase.developViewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.playIntegrityConfig.update	Owner (roles/owner) Editor (roles/editor) Firebase Admin (roles/firebase.admin) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase Develop Admin (roles/firebase.developAdmin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.recaptchaEnterpriseConfig.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Firebase Admin (roles/firebase.admin) Firebase Editor (roles/firebase.editor) Firebase Viewer (roles/firebase.viewer) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase App Check Viewer (roles/firebaseappcheck.viewer) Firebase Develop Admin (roles/firebase.developAdmin) Firebase Develop Viewer (roles/firebase.developViewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.recaptchaEnterpriseConfig.update	Owner (roles/owner) Editor (roles/editor) Firebase Admin (roles/firebase.admin) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase Develop Admin (roles/firebase.developAdmin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.recaptchaV3Config.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Firebase Admin (roles/firebase.admin) Firebase Editor (roles/firebase.editor) Firebase Viewer (roles/firebase.viewer) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase App Check Viewer (roles/firebaseappcheck.viewer) Firebase Develop Admin (roles/firebase.developAdmin) Firebase Develop Viewer (roles/firebase.developViewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.recaptchaV3Config.update	Owner (roles/owner) Editor (roles/editor) Firebase Admin (roles/firebase.admin) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase Develop Admin (roles/firebase.developAdmin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.resourcePolicies.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Firebase Admin (roles/firebase.admin) Firebase Editor (roles/firebase.editor) Firebase Viewer (roles/firebase.viewer) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase App Check Viewer (roles/firebaseappcheck.viewer) OAuth Config Editor (roles/oauthconfig.editor) OAuth Config Viewer (roles/oauthconfig.viewer) Firebase Develop Admin (roles/firebase.developAdmin) Firebase Develop Viewer (roles/firebase.developViewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.resourcePolicies.update	Owner (roles/owner) Editor (roles/editor) Firebase Admin (roles/firebase.admin) Firebase App Check Admin (roles/firebaseappcheck.admin) OAuth Config Editor (roles/oauthconfig.editor) Firebase Develop Admin (roles/firebase.developAdmin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.safetyNetConfig.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Firebase Admin (roles/firebase.admin) Firebase Editor (roles/firebase.editor) Firebase Viewer (roles/firebase.viewer) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase App Check Viewer (roles/firebaseappcheck.viewer) Firebase Develop Admin (roles/firebase.developAdmin) Firebase Develop Viewer (roles/firebase.developViewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.safetyNetConfig.update	Owner (roles/owner) Editor (roles/editor) Firebase Admin (roles/firebase.admin) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase Develop Admin (roles/firebase.developAdmin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.services.get	Owner (roles/owner) Editor (roles/editor) Viewer (roles/viewer) Firebase Admin (roles/firebase.admin) Firebase Editor (roles/firebase.editor) Firebase Viewer (roles/firebase.viewer) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase App Check Viewer (roles/firebaseappcheck.viewer) Firebase Develop Admin (roles/firebase.developAdmin) Firebase Develop Viewer (roles/firebase.developViewer) Support User (roles/iam.supportUser) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)
firebaseappcheck.services.update	Owner (roles/owner) Editor (roles/editor) Firebase Admin (roles/firebase.admin) Firebase App Check Admin (roles/firebaseappcheck.admin) Firebase Develop Admin (roles/firebase.developAdmin) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (roles/firebase.sdkAdminServiceAgent)