GOgoogle
projects

POST /v1/projects/{projectsId}/apps/{appsId}:mintAppCheckToken

Changed on

Mints a new App Check token for the specified Firebase App. This method is intended to be called from a privileged environment where the caller can be authorized via Cloud IAM; for example, using a service account. To call this method, the caller must have the firebaseappcheck.googleapis.com/tokens.mint permission. Returns a MintAppCheckTokenResponse.

Request

  • Base URL
    https://firebaseappcheck.googleapis.com
  • URL
    https://firebaseappcheck.googleapis.com/v1/projects/{projectsId}/apps/{appsId}:mintAppCheckToken
  • Auth
    • OAuth 2 and OAuth 2
      Implicit: https://accounts.google.com/o/oauth2/auth
      Scopes: https://www.googleapis.com/auth/cloud-platform
      Authorization code: https://accounts.google.com/o/oauth2/auth
      Token URL: https://accounts.google.com/o/oauth2/token scopes: https://www.googleapis.com/auth/cloud-platform
    • or OAuth 2 and OAuth 2
      Implicit: https://accounts.google.com/o/oauth2/auth
      Scopes: https://www.googleapis.com/auth/firebase
      Authorization code: https://accounts.google.com/o/oauth2/auth
      Token URL: https://accounts.google.com/o/oauth2/token scopes: https://www.googleapis.com/auth/firebase

Path parameters

projectsIdstring required
appsIdstring required

Request body

tokenTtlstring google-duration

Optional. If specified, the returned App Check token will be a session token, valid for the specified duration. Must be between 30 minutes and 7 days, inclusive.

Response

Successful response

tokenstring

The App Check token, used to access backend services protected by App Check. App Check tokens are signed JWTs containing claims that identify the attested app and GCP project. This token is used to access Google services protected by App Check. These tokens can also be verified by your own custom backends using the Firebase Admin SDK or third-party libraries.

ttlstring google-duration

The duration from the time this token is minted until its expiration. This field is intended to ease client-side token management, since the client may have clock skew, but is still able to accurately measure a duration.

Changes

  • c29fb33abe91Revision changes
    • info

      the security scope https://www.googleapis.com/auth/cloud-platform was added to the endpoint's security scheme Oauth2

    • info

      the security scope https://www.googleapis.com/auth/cloud-platform was added to the endpoint's security scheme Oauth2c

    • info

      the security scope https://www.googleapis.com/auth/firebase was removed from the endpoint's security scheme Oauth2

    • info

      the security scope https://www.googleapis.com/auth/firebase was removed from the endpoint's security scheme Oauth2c