Firebase uses service accounts to operate and manage services without sharing
user credentials. When you create a Firebase project or
[add Firebase to an existing Google Cloud project](https://firebase.google.com/docs/projects/use-firebase-with-existing-cloud-project.md.txt),
you might notice that a couple service accounts are already available in your
Firebase project.

You might also notice that new service accounts are added to your Firebase
project when you start using services or perform certain actions (for example,
linking a Firebase product to BigQuery). Some of these service accounts
are added directly by Firebase; others are added by the Google Cloud project
associated with your Firebase project.

You can view all service accounts for your project in the
[**Service accounts**](https://console.firebase.google.com/u/0/project/_/settings/serviceaccounts)
tab of your
\> **Project Settings** in the
Firebase console.

Here is the list of Firebase-related service accounts:

| Service account name | Account usage | When account is added to project |
|---|---|---|
| service-<var translate="no">PROJECT_NUMBER</var>@gcp-sa-firebase.iam.gserviceaccount.com | To manage and link Firebase services to Google Cloud projects (required for all Firebase projects) | Added at the time of creating a Firebase project / adding Firebase services to an existing Google Cloud project > [!NOTE] > **Note** : Some Firebase projects don't contain this service account. In case it's missing, a developer can manually add this service account to their project as "Firebase Service Management Service Agent" (`roles/firebase.managementServiceAgent`) in the Google Cloud console. |
| firebase-adminsdk-<var translate="no">random5char</var>@<var translate="no">PROJECT_ID</var>.iam.gserviceaccount.com | To provide credentials for the Firebase Admin SDK | Added at the time of creating a Firebase project / adding Firebase services to an existing Google Cloud project |
| service-<var translate="no">PROJECT_ID</var>@gcp-sa-firebasevertexai.iam.gserviceaccount.com | To authorize use of the Gemini Developer API and the Agent Platform Gemini API (formerly Vertex AI) via Firebase AI Logic. [Learn more about this service account.](https://firebase.google.com/docs/ai-logic/faq-and-troubleshooting.md.txt#security) | Added at the time of enabling Firebase AI Logic |
| firebase-app-hosting-compute@<var translate="no">PROJECT ID</var>.iam.gserviceaccount.com | To build, run, and monitor your app. It also has permission to [authenticate the Admin SDK with Application Default Credentials](https://firebase.google.com/docs/admin/setup.md.txt#initialize-sdk), for performing operations like loading data from Cloud Firestore. [Learn more about this service account.](https://firebase.google.com/docs/app-hosting/about-app-hosting.md.txt#service-account) | Added at the time of enabling Firebase App Hosting |
| service-<var translate="no">PROJECT_NUMBER</var>@gcf-admin-robot.iam.gserviceaccount.com | To operate Cloud Functions for Firebase | *(as of 2020)* Added at the time of enabling the Cloud Functions API in the project *(legacy)* Added at the time of creating a Firebase project / adding Firebase services to an existing Google Cloud project Might have already existed for some Google Cloud projects before adding Firebase to the project. |
| service-<var translate="no">PROJECT_NUMBER</var>@firebase-rules.iam.gserviceaccount.com | To manage access via Firebase Security Rules for Cloud Firestore | *(as of 2021)* Added at the time of provisioning the project's first Cloud Firestore instance *(legacy)* Added at the time of creating a Firebase project / adding Firebase services to an existing Google Cloud project |
| <var translate="no">PROJECT_ID</var>@appspot.gserviceaccount.com | To manage resources associated with App Engine: - default Cloud Firestore instance - default `.appspot` Cloud Storage for Firebase bucket - Cloud Functions for Firebase (1st gen scheduled functions) | *(as of 2021)* Added at the time of provisioning the project's App Engine app *(legacy)* Added at the time of creating a Firebase project / adding Firebase services to an existing Google Cloud project Might have already existed for some Google Cloud projects before adding Firebase to the project. |
| service-<var translate="no">PROJECT_NUMBER</var>@gcp-sa-firebasestorage.iam.gserviceaccount.com | To manage Cloud Storage for Firebase buckets | Added at the time of provisioning the project's first Cloud Storage for Firebase bucket / importing an existing Cloud Storage bucket into Firebase In 2022, this service account was added to all existing projects that had a Cloud Storage for Firebase bucket. See the [FAQ](https://firebase.google.com/docs/storage/faq-and-troubleshooting.md.txt#storage-accounts). |
| firebase-measurement@system.gserviceaccount.com | To export Google Analytics data to BigQuery | Added at the time of linking any Firebase product to BigQuery |
| crashlytics-exporter@crashlytics-bigquery-prod.iam.gserviceaccount.com | To export Firebase Crashlytics data to BigQuery | Added at the time of linking any Firebase product to BigQuery |
| service-<var translate="no">PROJECT_NUMBER</var>@gcp-sa-crashlytics.iam.gserviceaccount.com | To export Firebase Crashlytics data to BigQuery using streaming export | Added at the time of enabling Crashlytics streaming export to BigQuery |
| exporter@fcm-bq-export-prod.iam.gserviceaccount.com | To export Firebase Cloud Messaging data to BigQuery | Added at the time of linking any Firebase product to BigQuery |
| exporter@performance-bq-export-prod.iam.gserviceaccount.com | To export Firebase Performance Monitoring data to BigQuery | Added at the time of linking any Firebase product to BigQuery |
| service-<var translate="no">PROJECT_NUMBER</var>@gcp-sa-bigquerydatatransfer.iam.gserviceaccount.com | To import data into BigQuery from any Firebase product (that is, Google Analytics, Crashlytics, Cloud Messaging, and Performance Monitoring) | Added at the time of linking any Firebase product to BigQuery |
| ext-<var translate="no">EXTENSION_INSTANCE_ID</var>@<var translate="no">PROJECT_ID</var>.iam.gserviceaccount.com | To manage installation of and to run a Firebase extension | Added at the time of installing an extension (each extension instance has its own service account) |
| **Deprecated service accounts** |||
| ***(deprecated)*** <var translate="no">PROJECT_NUMBER</var>@cloudservices.gserviceaccount.com | ***(deprecated)*** To use Google APIs | ***(deprecated)*** No longer added to Firebase projects. Added at the time of creating a Firebase project / adding Firebase services to an existing Google Cloud project Might have already existed for some Google Cloud projects before adding Firebase to the project. |
| ***(deprecated)*** firebase-service-account@firebase-sa-management.iam.gserviceaccount.com | ***(deprecated)*** To manage and link Firebase services to Google Cloud projects | ***(deprecated)*** No longer added to Firebase projects. Added at the time of creating a Firebase project / adding Firebase services to an existing Google Cloud project |
| ***(deprecated)*** firebase-storage@system.gserviceaccount.com | ***(deprecated)*** To manage Cloud Storage for Firebase buckets | ***(deprecated)*** No longer added to Firebase projects. Added at the time of creating a Firebase project / adding Firebase services to an existing Google Cloud project As of 2022, the `firebase-storage@` service account is no longer added to new projects. See the [FAQ](https://firebase.google.com/docs/storage/faq-and-troubleshooting.md.txt#storage-accounts). |
| ***(deprecated)*** firebase-crashreporting-<var translate="no">random4char</var>@<var translate="no">PROJECT_ID</var>.iam.gserviceaccount.com | ***(deprecated)*** To upload crash symbols to Firebase Crash Reporting | ***(deprecated)*** No longer added to Firebase projects. Added at the time of creating a Firebase project / adding Firebase services to an existing Google Cloud project |