projects

PATCH /v1/projects/{projectsId}/apps/{appsId}/deviceCheckConfig

Changed on Nov 2, 2026

Updates the DeviceCheckConfig for the specified app. While this configuration is incomplete or invalid, the app will be unable to exchange DeviceCheck tokens for App Check tokens. For security reasons, the private_key field is never populated in the response.

Request

Base URL
https://firebaseappcheck.googleapis.com
URL
https://firebaseappcheck.googleapis.com/v1/projects/{projectsId}/apps/{appsId}/deviceCheckConfig
Auth
- OAuth 2 and OAuth 2
  Implicit: https://accounts.google.com/o/oauth2/auth
  Scopes: https://www.googleapis.com/auth/cloud-platform
  Authorization code: https://accounts.google.com/o/oauth2/auth
  Token URL: https://accounts.google.com/o/oauth2/token scopes: https://www.googleapis.com/auth/cloud-platform
- or OAuth 2 and OAuth 2
  Implicit: https://accounts.google.com/o/oauth2/auth
  Scopes: https://www.googleapis.com/auth/firebase
  Authorization code: https://accounts.google.com/o/oauth2/auth
  Token URL: https://accounts.google.com/o/oauth2/token scopes: https://www.googleapis.com/auth/firebase

Path parameters

projectsIdstring required

appsIdstring required

Query parameters

updateMaskstring google-fieldmask

Required. A comma-separated list of names of fields in the DeviceCheckConfig to update. Example: key_id,private_key.

Request body

keyIdstring

Required. The key identifier of a private key enabled with DeviceCheck, created in your Apple Developer account.

namestring

Required. The relative resource name of the DeviceCheck configuration object, in the format: projects/{project_number}/apps/{app_id}/deviceCheckConfig

privateKeystring

Required. Input only. The contents of the private key (.p8) file associated with the key specified by key_id. For security reasons, this field will never be populated in any response.

privateKeySetboolean

Output only. Whether the private_key field was previously set. Since we will never return the private_key field, this field is the only way to find out whether it was previously set.

tokenTtlstring google-duration

Specifies the duration for which App Check tokens exchanged from DeviceCheck tokens will be valid. If unset, a default value of 1 hour is assumed. Must be between 30 minutes and 7 days, inclusive.

Response

Successful response