[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-25 (世界標準時間)。"],[],[],null,["\u003cbr /\u003e\n\nFor a Firebase Extension to perform its specified actions, Firebase\ngrants each instance of an installed extension limited access to your project\nand data via a ***service account***.\n\nWhat's a service account?\n\n**A\n[service account](//cloud.google.com/iam/docs/understanding-service-accounts)\nis a special type of Google user account. It represents a non-human user that's\nauthorized to access data using Google APIs.**\n\nDuring installation of an extension, Firebase creates a service account in your\nproject. Each installed instance of an extension has its own service account.\n\nFirebase limits access to your project and data by assigning an extension's\nservice account specific [***roles*** (bundles of\npermissions)](/docs/projects/iam/roles). The roles that an extension requires to\noperate are determined by Firebase during extension development. At\ninstallation, Firebase assigns these roles to an extension's service account,\nand you shouldn't modify, add to, or delete any of these assigned roles\n(otherwise your installed extension won't work as expected). You can, though,\n[uninstall the extension](#uninstall-extension), which deletes the service\naccount (and its access) altogether.\n\nService accounts created for extensions are in the format:\n**ext-** \u003cvar translate=\"no\"\u003eextension-instance-id\u003c/var\u003e***@*** \u003cvar translate=\"no\"\u003eproject-id\u003c/var\u003e**.iam.gserviceaccount.com**.\n\nYou can view all the service accounts associated with your Firebase project in\nthe\n[*Service accounts*](//console.firebase.google.com/project/_/settings/serviceaccounts/adminsdk)\ntab of your\nsettings *Project settings*.\n\nPermissions and roles\n\nDuring development of an extension, Firebase determines the level of access that\nan extension requires to operate.\n\nFirebase defines this level of access by explicitly listing the ***roles***\n(bundles of permissions) that Firebase should assign to the extension's\n[service account](#service-account) during installation of the extension.\n\nEach role (and its inherent permissions) is based on a specific product or\nservice. Examples of roles are `firebasehosting.admin`, `bigquery.dataEditor`,\nand `firebasedatabase.admin`. Firebase lists the required roles for an extension\nin the extension's specification file (the\n[`extension.yaml` file](/docs/extensions/overview-use-extensions#view-source-code)).\n\nFor official Firebase extensions, Firebase thoroughly reviews this list of\nroles to ensure that an extension's access is strictly limited to the scope of\nthe extension's tasks. You can also review and confirm for yourself the access\ngranted to an extension by viewing the extension's details page in the\n[Firebase Extensions dashboard](https://console.firebase.google.com/project/_/extensions/) or viewing its\n[`README` file](/docs/extensions/overview-use-extensions#view-source-code).\n\nLearn about the permissions included in each role:\n\n- [Firebase product-level roles](/docs/projects/iam/roles-predefined-product)\n- [Google Cloud\n roles](//cloud.google.com/iam/docs/understanding-roles#predefined_roles)\n\nWhat happens when I uninstall an extension?\n\nWhen you\n[uninstall an extension](/docs/extensions/manage-installed-extensions#uninstall)\nfrom your project, Firebase deletes the [service account](#service-account)\ncreated for that instance of the extension. After this deletion of the service\naccount, the extension cannot run in your project because it no longer has any\naccess rights to your project or data."]]
