Firebase App Check roles and permissions

This page lists the IAM roles and permissions for Firebase App Check. To search through all roles and permissions, see the role and permission index.

Firebase App Check roles

Role Permissions

Role	Permissions
Firebase App Check Admin (`roles/firebaseappcheck.admin`) Full management of Firebase App Check.	`firebaseappcheck.*` `firebaseappcheck.appAttestConfig.get` `firebaseappcheck.appAttestConfig.update` `firebaseappcheck.appCheckTokens.verify` `firebaseappcheck.automations.create` `firebaseappcheck.automations.delete` `firebaseappcheck.automations.get` `firebaseappcheck.automations.list` `firebaseappcheck.automations.resume` `firebaseappcheck.automations.suspend` `firebaseappcheck.automations.update` `firebaseappcheck.debugTokens.get` `firebaseappcheck.debugTokens.update` `firebaseappcheck.deviceCheckConfig.get` `firebaseappcheck.deviceCheckConfig.update` `firebaseappcheck.playIntegrityConfig.get` `firebaseappcheck.playIntegrityConfig.update` `firebaseappcheck.recaptchaEnterpriseConfig.get` `firebaseappcheck.recaptchaEnterpriseConfig.update` `firebaseappcheck.recaptchaV3Config.get` `firebaseappcheck.recaptchaV3Config.update` `firebaseappcheck.resourcePolicies.get` `firebaseappcheck.resourcePolicies.update` `firebaseappcheck.safetyNetConfig.get` `firebaseappcheck.safetyNetConfig.update` `firebaseappcheck.services.get` `firebaseappcheck.services.update` `firebaseappcheck.tokens.mint`
Firebase App Check Viewer (`roles/firebaseappcheck.viewer`) Read-only access for Firebase App Check.	`firebaseappcheck.appAttestConfig.get` `firebaseappcheck.automations.get` `firebaseappcheck.automations.list` `firebaseappcheck.debugTokens.get` `firebaseappcheck.deviceCheckConfig.get` `firebaseappcheck.playIntegrityConfig.get` `firebaseappcheck.recaptchaEnterpriseConfig.get` `firebaseappcheck.recaptchaV3Config.get` `firebaseappcheck.resourcePolicies.get` `firebaseappcheck.safetyNetConfig.get` `firebaseappcheck.services.get`
Firebase App Check Token Verifier (`roles/firebaseappcheck.tokenVerifier`) Access to token verification capabilities for Firebase App Check.	`firebaseappcheck.appCheckTokens.verify`

Firebase App Check Admin

(roles/firebaseappcheck.admin)

Full management of Firebase App Check.

firebaseappcheck.*

firebaseappcheck.appAttestConfig.get
firebaseappcheck.appAttestConfig.update
firebaseappcheck.appCheckTokens.verify
firebaseappcheck.automations.create
firebaseappcheck.automations.delete
firebaseappcheck.automations.get
firebaseappcheck.automations.list
firebaseappcheck.automations.resume
firebaseappcheck.automations.suspend
firebaseappcheck.automations.update
firebaseappcheck.debugTokens.get
firebaseappcheck.debugTokens.update
firebaseappcheck.deviceCheckConfig.get
firebaseappcheck.deviceCheckConfig.update
firebaseappcheck.playIntegrityConfig.get
firebaseappcheck.playIntegrityConfig.update
firebaseappcheck.recaptchaEnterpriseConfig.get
firebaseappcheck.recaptchaEnterpriseConfig.update
firebaseappcheck.recaptchaV3Config.get
firebaseappcheck.recaptchaV3Config.update
firebaseappcheck.resourcePolicies.get
firebaseappcheck.resourcePolicies.update
firebaseappcheck.safetyNetConfig.get
firebaseappcheck.safetyNetConfig.update
firebaseappcheck.services.get
firebaseappcheck.services.update
firebaseappcheck.tokens.mint

Firebase App Check Viewer

(roles/firebaseappcheck.viewer)

Read-only access for Firebase App Check.

firebaseappcheck.appAttestConfig.get

firebaseappcheck.automations.get

firebaseappcheck.automations.list

firebaseappcheck.debugTokens.get

firebaseappcheck.deviceCheckConfig.get

firebaseappcheck.playIntegrityConfig.get

firebaseappcheck.recaptchaEnterpriseConfig.get

firebaseappcheck.recaptchaV3Config.get

firebaseappcheck.resourcePolicies.get

firebaseappcheck.safetyNetConfig.get

firebaseappcheck.services.get

Firebase App Check Token Verifier

(roles/firebaseappcheck.tokenVerifier)

Access to token verification capabilities for Firebase App Check.

firebaseappcheck.appCheckTokens.verify

Service agent roles

Service agent roles should only be granted to service agents.

Role Permissions

Role	Permissions
Firebase App Check Service Agent (`roles/firebaseappcheck.serviceAgent`) Grants Firebase App Check Service Account access to consumer app attestation resources, such as reCAPTCHA Enterprise and Play Integrity API. Warning: Do not grant service agent roles to any principals except service agents.	`recaptchaenterprise.assessments.*` `recaptchaenterprise.assessments.annotate` `recaptchaenterprise.assessments.create` `serviceusage.services.use`

Firebase App Check Service Agent

(roles/firebaseappcheck.serviceAgent)

Grants Firebase App Check Service Account access to consumer app attestation resources, such as reCAPTCHA Enterprise and Play Integrity API.

recaptchaenterprise.assessments.*

recaptchaenterprise.assessments.annotate
recaptchaenterprise.assessments.create

serviceusage.services.use

Firebase App Check permissions

Permission	Included in roles
`firebaseappcheck.appAttestConfig.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Editor (`roles/firebase.editor`) Firebase Viewer (`roles/firebase.viewer`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase App Check Viewer (`roles/firebaseappcheck.viewer`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.appAttestConfig.update`	Owner (`roles/owner`) Editor (`roles/editor`) Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.appCheckTokens.verify`	Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase App Check Token Verifier (`roles/firebaseappcheck.tokenVerifier`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.automations.create`	Owner (`roles/owner`) Editor (`roles/editor`) Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.automations.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.automations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Editor (`roles/firebase.editor`) Firebase Viewer (`roles/firebase.viewer`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase App Check Viewer (`roles/firebaseappcheck.viewer`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.automations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Editor (`roles/firebase.editor`) Firebase Viewer (`roles/firebase.viewer`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase App Check Viewer (`roles/firebaseappcheck.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Security Auditor (`roles/iam.securityAuditor`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.automations.resume`	Owner (`roles/owner`) Editor (`roles/editor`) Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.automations.suspend`	Owner (`roles/owner`) Editor (`roles/editor`) Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.automations.update`	Owner (`roles/owner`) Editor (`roles/editor`) Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.debugTokens.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Editor (`roles/firebase.editor`) Firebase Viewer (`roles/firebase.viewer`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase App Check Viewer (`roles/firebaseappcheck.viewer`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.debugTokens.update`	Owner (`roles/owner`) Editor (`roles/editor`) Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.deviceCheckConfig.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Editor (`roles/firebase.editor`) Firebase Viewer (`roles/firebase.viewer`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase App Check Viewer (`roles/firebaseappcheck.viewer`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.deviceCheckConfig.update`	Owner (`roles/owner`) Editor (`roles/editor`) Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.playIntegrityConfig.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Editor (`roles/firebase.editor`) Firebase Viewer (`roles/firebase.viewer`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase App Check Viewer (`roles/firebaseappcheck.viewer`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.playIntegrityConfig.update`	Owner (`roles/owner`) Editor (`roles/editor`) Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.recaptchaEnterpriseConfig.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Editor (`roles/firebase.editor`) Firebase Viewer (`roles/firebase.viewer`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase App Check Viewer (`roles/firebaseappcheck.viewer`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Service Management Service Agent (`roles/firebase.managementServiceAgent`) Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.recaptchaEnterpriseConfig.update`	Owner (`roles/owner`) Editor (`roles/editor`) Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Service Management Service Agent (`roles/firebase.managementServiceAgent`) Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.recaptchaV3Config.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Editor (`roles/firebase.editor`) Firebase Viewer (`roles/firebase.viewer`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase App Check Viewer (`roles/firebaseappcheck.viewer`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Service Management Service Agent (`roles/firebase.managementServiceAgent`) Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.recaptchaV3Config.update`	Owner (`roles/owner`) Editor (`roles/editor`) Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.resourcePolicies.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Editor (`roles/firebase.editor`) Firebase Viewer (`roles/firebase.viewer`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase App Check Viewer (`roles/firebaseappcheck.viewer`) OAuth Config Editor (`roles/oauthconfig.editor`) OAuth Config Viewer (`roles/oauthconfig.viewer`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.resourcePolicies.update`	Owner (`roles/owner`) Editor (`roles/editor`) Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) OAuth Config Editor (`roles/oauthconfig.editor`) Firebase Develop Admin (`roles/firebase.developAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.safetyNetConfig.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Editor (`roles/firebase.editor`) Firebase Viewer (`roles/firebase.viewer`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase App Check Viewer (`roles/firebaseappcheck.viewer`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.safetyNetConfig.update`	Owner (`roles/owner`) Editor (`roles/editor`) Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.services.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Editor (`roles/firebase.editor`) Firebase Viewer (`roles/firebase.viewer`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase App Check Viewer (`roles/firebaseappcheck.viewer`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Support User (`roles/iam.supportUser`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Service Management Service Agent (`roles/firebase.managementServiceAgent`) Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.services.update`	Owner (`roles/owner`) Editor (`roles/editor`) Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Service Management Service Agent (`roles/firebase.managementServiceAgent`) Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)
`firebaseappcheck.tokens.mint`	Owner (`roles/owner`) Editor (`roles/editor`) Firebase Admin (`roles/firebase.admin`) Firebase App Check Admin (`roles/firebaseappcheck.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase Admin SDK Administrator Service Agent (`roles/firebase.sdkAdminServiceAgent`)

Firebase App Check roles and permissions