---
title: "POST /v1/projects/{projectsId}/apps/{appsId}:exchangeCustomToken"
method: POST
path: "/v1/projects/{projectsId}/apps/{appsId}:exchangeCustomToken"
tags: ["projects"]
---

# POST /v1/projects/{projectsId}/apps/{appsId}:exchangeCustomToken

`POST /v1/projects/{projectsId}/apps/{appsId}:exchangeCustomToken`

## Request

- Base URL: `https://firebaseappcheck.googleapis.com`
- URL: `https://firebaseappcheck.googleapis.com/v1/projects/{projectsId}/apps/{appsId}:exchangeCustomToken`
- Auth: one of:
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/cloud-platform`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/cloud-platform`
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/firebase`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/firebase`

Validates a custom token signed using your project's Admin SDK service account credentials. If valid, returns an AppCheckToken.

## Path parameters

- `projectsId` string, required
- `appsId` string, required

## Request body

- GoogleFirebaseAppcheckV1ExchangeCustomTokenRequest: Request message for the ExchangeCustomToken method.
  - `customToken` string: Required. A custom token signed using your project's Admin SDK service account credentials.
  - `jti` string: Optional. When `limited_use` is set to `true`, this field specifies the desired `jti` claim (Section 4.1.7 of RFC 7519) in the returned App Check token. *Limited use* App Check tokens with the same `jti` will be counted as the same token for the purposes of replay protection. An error is returned if this field is specified without setting `limited_use` to `true`. The size of this field is limited to 250 bytes. If specified, its length must be at least 16 bytes. If this field is omitted or is empty and `limited_use` is set to `true`, a randomly generated `jti` claim with length between 16 and 250 bytes (inclusive) will be used in the returned App Check token. Leaving this field empty is only recommended if your custom attestation provider itself is not vulnerable to replay attacks. When `limited_use` is set to `false`, the presence and the contents of the `jti` claim in the returned App Check token are unspecified. To ensure that the returned App Check token is eligible for limited-use functionality, set `limited_use` to `true`.
  - `limitedUse` boolean: Specifies whether this attestation is for use in a *limited use* (`true`) or *session based* (`false`) context. To enable this attestation to be used with the *replay protection* feature, set this to `true`. The default value is `false`.

## Response `200`

Successful response

- GoogleFirebaseAppcheckV1AppCheckToken: Encapsulates an *App Check token*, which are used to access backend services protected by App Check.
  - `token` string: The App Check token. App Check tokens are signed [JWTs](https://www.rfc-editor.org/info/rfc7519/) containing claims that identify the attested app and GCP project. This token is used to access Google services protected by App Check. These tokens can also be [verified by your own custom backends](https://firebase.google.com/docs/app-check/custom-resource-backend) using the Firebase Admin SDK or third-party libraries.
  - `ttl` string, google-duration: The duration from the time this token is minted until its expiration. This field is intended to ease client-side token management, since the client may have clock skew, but is still able to accurately measure a duration.

## Changes

- **2026-11-02** `c29fb33abe91`: 4 info
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2c`
  - the security scope `https://www.googleapis.com/auth/firebase` was removed from the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/firebase` was removed from the endpoint's security scheme `Oauth2c`

[Operation history](https://skmtc.dev/google/apis/firebaseappcheck/changes/v1/projects/:projectsId/apps/:appsId:exchangeCustomToken/post.md)

---

[API](https://skmtc.dev/google/apis/firebaseappcheck.md) - [All operations](https://skmtc.dev/google/apis/firebaseappcheck/llms.txt) - [OpenAPI document](https://skmtc.dev/google/apis/firebaseappcheck/revisions/c29fb33abe91?raw)