Firebase Service Accounts Overview

Firebase uses service accounts to operate and manage services without sharing user credentials. When you create a Firebase project, you might notice that a number of service accounts are already available in your project.

You might also notice that new service accounts are added to your project when you add services or perform certain actions (for example, linking a Firebase product to BigQuery). Some of these service accounts are added directly by Firebase; others are added via the Google Cloud project associated with your Firebase project.

You can view all service accounts associated with your project in the Service accounts tab of your > Project Settings in the Firebase console.

Here is a list of Firebase-managed service accounts:

Account Name Account usage When added to project
firebase-service-account@firebase-sa-management.iam.gserviceaccount.com To manage and link Firebase services to Google Cloud projects - required for all Firebase projects

At time of Firebase project creation / adding Firebase services to an existing Google Cloud project

Note: Some Firebase projects created before September 2018 do not contain this service account. However, Firebase automatically adds this service account to any of these projects when an action requiring this service account is next performed.

service-project-number@gcp-sa-firebaseappcheck.iam.gserviceaccount.com To verify response tokens issued by the following App Check providers:
  • reCAPTCHA Enterprise
  • Play Integrity API
At time of registering an app to use App Check with the following providers:
  • reCAPTCHA Enterprise
  • Play Integrity API
project-id@appspot.gserviceaccount.com To manage products associated with App Engine: Cloud Firestore, Cloud Storage for Firebase, and Cloud Functions for Firebase At time of Firebase project creation / import of Google Cloud project to Firebase
Might already exist for Google Cloud projects before import
service-project-number@firebase-rules.iam.gserviceaccount.com To manage Firebase Security Rules for Cloud Firestore, Cloud Storage for Firebase, and Realtime Database At time of Firebase project creation / import of Google Cloud project to Firebase
service-project number@gcp-sa-firebasestorage.iam.gserviceaccount.com

(deprecated) firebase-storage@system.gserviceaccount.com
To manage Cloud Storage for Firebase buckets. At time of Firebase project creation / import of Google Cloud project to Firebase.
firebase-storage@ service account are no longer assigned to new projects. See the support FAQ.
service-project-number@gcf-admin-robot.iam.gserviceaccount.com To operate Cloud Functions for Firebase At time of Firebase project creation / import of Google Cloud project to Firebase
Might already exist for Google Cloud projects before import
project-number@cloudservices.gserviceaccount.com To use Google APIs At time of Firebase project creation / import of Google Cloud project to Firebase
Might already exist for Google Cloud projects before import
firebase-adminsdk-random5chars@project-id.iam.gserviceaccount.com To provide credentials for the Firebase Admin SDK At time of Firebase project creation / import of Google Cloud project to Firebase
firebase-measurement@system.gserviceaccount.com To export Firebase data from Google Analytics to BigQuery At time of linking any Firebase product to BigQuery
crashlytics-exporter@crashlytics-bigquery-prod.iam.gserviceaccount.com To export data from Firebase Crashlytics to BigQuery At time of linking any Firebase product to BigQuery
exporter@fcm-bq-export-prod.iam.gserviceaccount.com To export data from Firebase Cloud Messaging to BigQuery At time of linking any Firebase product to BigQuery
exporter@performance-bq-export-prod.iam.gserviceaccount.com To export data from Firebase Performance Monitoring to BigQuery At time of linking any Firebase product to BigQuery
service-project-number@gcp-sa-bigquerydatatransfer.iam.gserviceaccount.com To import data into BigQuery from any Firebase product (Google Analytics, Crashlytics, Cloud Messaging, Performance Monitoring) At time of linking any Firebase product to BigQuery
ext-extension-instance-id@project-id.iam.gserviceaccount.com To manage installation of and to run a Firebase extension At time of extension installation (each extension instance has its own service account)
(deprecated) firebase-crashreporting-random4char@project-name.iam.gserviceaccount.com To upload crash symbols to Firebase Crash Reporting At time of Firebase project creation