GOgoogle
projects

POST /v1/projects/{projectsId}/apps/{appsId}:exchangeCustomToken

Changed on

Validates a custom token signed using your project's Admin SDK service account credentials. If valid, returns an AppCheckToken.

Request

  • Base URL
    https://firebaseappcheck.googleapis.com
  • URL
    https://firebaseappcheck.googleapis.com/v1/projects/{projectsId}/apps/{appsId}:exchangeCustomToken
  • Auth
    • OAuth 2 and OAuth 2
      Implicit: https://accounts.google.com/o/oauth2/auth
      Scopes: https://www.googleapis.com/auth/cloud-platform
      Authorization code: https://accounts.google.com/o/oauth2/auth
      Token URL: https://accounts.google.com/o/oauth2/token scopes: https://www.googleapis.com/auth/cloud-platform
    • or OAuth 2 and OAuth 2
      Implicit: https://accounts.google.com/o/oauth2/auth
      Scopes: https://www.googleapis.com/auth/firebase
      Authorization code: https://accounts.google.com/o/oauth2/auth
      Token URL: https://accounts.google.com/o/oauth2/token scopes: https://www.googleapis.com/auth/firebase

Path parameters

projectsIdstring required
appsIdstring required

Request body

customTokenstring

Required. A custom token signed using your project's Admin SDK service account credentials.

jtistring

Optional. When limited_use is set to true, this field specifies the desired jti claim (Section 4.1.7 of RFC 7519) in the returned App Check token. Limited use App Check tokens with the same jti will be counted as the same token for the purposes of replay protection. An error is returned if this field is specified without setting limited_use to true. The size of this field is limited to 250 bytes. If specified, its length must be at least 16 bytes. If this field is omitted or is empty and limited_use is set to true, a randomly generated jti claim with length between 16 and 250 bytes (inclusive) will be used in the returned App Check token. Leaving this field empty is only recommended if your custom attestation provider itself is not vulnerable to replay attacks. When limited_use is set to false, the presence and the contents of the jti claim in the returned App Check token are unspecified. To ensure that the returned App Check token is eligible for limited-use functionality, set limited_use to true.

limitedUseboolean

Specifies whether this attestation is for use in a limited use (true) or session based (false) context. To enable this attestation to be used with the replay protection feature, set this to true. The default value is false.

Response

Successful response

tokenstring

The App Check token. App Check tokens are signed JWTs containing claims that identify the attested app and GCP project. This token is used to access Google services protected by App Check. These tokens can also be verified by your own custom backends using the Firebase Admin SDK or third-party libraries.

ttlstring google-duration

The duration from the time this token is minted until its expiration. This field is intended to ease client-side token management, since the client may have clock skew, but is still able to accurately measure a duration.

Changes

  • c29fb33abe91Revision changes
    • info

      the security scope https://www.googleapis.com/auth/cloud-platform was added to the endpoint's security scheme Oauth2

    • info

      the security scope https://www.googleapis.com/auth/cloud-platform was added to the endpoint's security scheme Oauth2c

    • info

      the security scope https://www.googleapis.com/auth/firebase was removed from the endpoint's security scheme Oauth2

    • info

      the security scope https://www.googleapis.com/auth/firebase was removed from the endpoint's security scheme Oauth2c