---
title: "POST /v1/projects/{projectsId}/apps/{appsId}:exchangeDebugToken"
method: POST
path: "/v1/projects/{projectsId}/apps/{appsId}:exchangeDebugToken"
tags: ["projects"]
---

# POST /v1/projects/{projectsId}/apps/{appsId}:exchangeDebugToken

`POST /v1/projects/{projectsId}/apps/{appsId}:exchangeDebugToken`

## Request

- Base URL: `https://firebaseappcheck.googleapis.com`
- URL: `https://firebaseappcheck.googleapis.com/v1/projects/{projectsId}/apps/{appsId}:exchangeDebugToken`
- Auth: one of:
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/cloud-platform`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/cloud-platform`
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/firebase`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/firebase`

Validates a debug token secret that you have previously created using CreateDebugToken. If valid, returns an AppCheckToken. Note that a restrictive quota is enforced on this method to prevent accidental exposure of the app to abuse.

## Path parameters

- `projectsId` string, required
- `appsId` string, required

## Request body

- GoogleFirebaseAppcheckV1ExchangeDebugTokenRequest: Request message for the ExchangeDebugToken method.
  - `debugToken` string: Required. A debug token secret. This string must match a debug token secret previously created using CreateDebugToken.
  - `limitedUse` boolean: Specifies whether this attestation is for use in a *limited use* (`true`) or *session based* (`false`) context. To enable this attestation to be used with the *replay protection* feature, set this to `true`. The default value is `false`.

## Response `200`

Successful response

- GoogleFirebaseAppcheckV1AppCheckToken: Encapsulates an *App Check token*, which are used to access backend services protected by App Check.
  - `token` string: The App Check token. App Check tokens are signed [JWTs](https://www.rfc-editor.org/info/rfc7519/) containing claims that identify the attested app and GCP project. This token is used to access Google services protected by App Check. These tokens can also be [verified by your own custom backends](https://firebase.google.com/docs/app-check/custom-resource-backend) using the Firebase Admin SDK or third-party libraries.
  - `ttl` string, google-duration: The duration from the time this token is minted until its expiration. This field is intended to ease client-side token management, since the client may have clock skew, but is still able to accurately measure a duration.

## Changes

- **2026-11-02** `c29fb33abe91`: 4 info
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2c`
  - the security scope `https://www.googleapis.com/auth/firebase` was removed from the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/firebase` was removed from the endpoint's security scheme `Oauth2c`

[Operation history](https://skmtc.dev/google/apis/firebaseappcheck/changes/v1/projects/:projectsId/apps/:appsId:exchangeDebugToken/post.md)

---

[API](https://skmtc.dev/google/apis/firebaseappcheck.md) - [All operations](https://skmtc.dev/google/apis/firebaseappcheck/llms.txt) - [OpenAPI document](https://skmtc.dev/google/apis/firebaseappcheck/revisions/c29fb33abe91?raw)