---
title: "PATCH /v1/projects/{projectsId}/apps/{appsId}/deviceCheckConfig"
method: PATCH
path: "/v1/projects/{projectsId}/apps/{appsId}/deviceCheckConfig"
tags: ["projects"]
---

# PATCH /v1/projects/{projectsId}/apps/{appsId}/deviceCheckConfig

`PATCH /v1/projects/{projectsId}/apps/{appsId}/deviceCheckConfig`

## Request

- Base URL: `https://firebaseappcheck.googleapis.com`
- URL: `https://firebaseappcheck.googleapis.com/v1/projects/{projectsId}/apps/{appsId}/deviceCheckConfig`
- Auth: one of:
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/cloud-platform`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/cloud-platform`
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/firebase`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/firebase`

Updates the DeviceCheckConfig for the specified app. While this configuration is incomplete or invalid, the app will be unable to exchange DeviceCheck tokens for App Check tokens. For security reasons, the `private_key` field is never populated in the response.

## Path parameters

- `projectsId` string, required
- `appsId` string, required

## Query parameters

- `updateMask` string, google-fieldmask

## Request body

- GoogleFirebaseAppcheckV1DeviceCheckConfig: An app's DeviceCheck configuration object. This configuration is used by ExchangeDeviceCheckToken to validate device tokens issued to apps by DeviceCheck. It also controls certain properties of the returned `AppCheckToken`, such as its ttl. Note that the Team ID registered with your app is used as part of the validation process. Please register it via the Firebase Console or programmatically via the [Firebase Management Service](https://firebase.google.com/docs/projects/api/reference/rest/v11/projects.iosApps/patch).
  - `keyId` string: Required. The key identifier of a private key enabled with DeviceCheck, created in your Apple Developer account.
  - `name` string: Required. The relative resource name of the DeviceCheck configuration object, in the format: ``` projects/{project_number}/apps/{app_id}/deviceCheckConfig ```
  - `privateKey` string: Required. Input only. The contents of the private key (`.p8`) file associated with the key specified by `key_id`. For security reasons, this field will never be populated in any response.
  - `privateKeySet` boolean: Output only. Whether the `private_key` field was previously set. Since we will never return the `private_key` field, this field is the only way to find out whether it was previously set.
  - `tokenTtl` string, google-duration: Specifies the duration for which App Check tokens exchanged from DeviceCheck tokens will be valid. If unset, a default value of 1 hour is assumed. Must be between 30 minutes and 7 days, inclusive.

## Response `200`

Successful response

- GoogleFirebaseAppcheckV1DeviceCheckConfig: An app's DeviceCheck configuration object. This configuration is used by ExchangeDeviceCheckToken to validate device tokens issued to apps by DeviceCheck. It also controls certain properties of the returned `AppCheckToken`, such as its ttl. Note that the Team ID registered with your app is used as part of the validation process. Please register it via the Firebase Console or programmatically via the [Firebase Management Service](https://firebase.google.com/docs/projects/api/reference/rest/v11/projects.iosApps/patch).
  - `keyId` string: Required. The key identifier of a private key enabled with DeviceCheck, created in your Apple Developer account.
  - `name` string: Required. The relative resource name of the DeviceCheck configuration object, in the format: ``` projects/{project_number}/apps/{app_id}/deviceCheckConfig ```
  - `privateKey` string: Required. Input only. The contents of the private key (`.p8`) file associated with the key specified by `key_id`. For security reasons, this field will never be populated in any response.
  - `privateKeySet` boolean: Output only. Whether the `private_key` field was previously set. Since we will never return the `private_key` field, this field is the only way to find out whether it was previously set.
  - `tokenTtl` string, google-duration: Specifies the duration for which App Check tokens exchanged from DeviceCheck tokens will be valid. If unset, a default value of 1 hour is assumed. Must be between 30 minutes and 7 days, inclusive.

## Changes

- **2026-11-02** `c29fb33abe91`: 4 info
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2c`
  - the security scope `https://www.googleapis.com/auth/firebase` was removed from the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/firebase` was removed from the endpoint's security scheme `Oauth2c`

[Operation history](https://skmtc.dev/google/apis/firebaseappcheck/changes/v1/projects/:projectsId/apps/:appsId/deviceCheckConfig/patch.md)

---

[API](https://skmtc.dev/google/apis/firebaseappcheck.md) - [All operations](https://skmtc.dev/google/apis/firebaseappcheck/llms.txt) - [OpenAPI document](https://skmtc.dev/google/apis/firebaseappcheck/revisions/c29fb33abe91?raw)