inmake DOCS
Docs / Cloud Instance / Connecting

Connecting

The Firebase project, the service-account key, roles and APIs, the EU/US destination.

Connecting happens on the space page (Account › Spaces › your space): open Advanced Cloud (collapsed by default) and use the PROD Cloud or DEMO Cloud card.

1. Prepare the Firebase project#

  • A Firebase project on the Blaze plan (the Realtime Database, the default bucket and the shim need it).
  • It may be new or already in use by your own systems: collections other than the platform's own (store, stock, promo, payments) are left alone and listed on the card.
  • One Firebase project serves one environment. A project connected on Production is refused on Demo, and the other way round.

2. Get a service-account key#

Option How Notes
Console key Firebase console › Project settings › Service accounts › Generate new private key Quickest. Its rights differ per project — the checklist tells you which roles to add.
Dedicated service account gcloud iam service-accounts create drop-core --project PROJECT_ID, grant it the roles below, gcloud iam service-accounts keys create key.json --iam-account drop-core@PROJECT_ID.iam.gserviceaccount.com Everything passes without further console work.

The key needs these roles on the project:

gcloud projects add-iam-policy-binding PROJECT_ID --member serviceAccount:SA_EMAIL --role roles/firebase.admin
gcloud projects add-iam-policy-binding PROJECT_ID --member serviceAccount:SA_EMAIL --role roles/iam.serviceAccountUser

and these APIs enabled (the key cannot enable APIs itself):

gcloud services enable firestore.googleapis.com firebasedatabase.googleapis.com firebasestorage.googleapis.com \
  cloudfunctions.googleapis.com cloudbuild.googleapis.com artifactregistry.googleapis.com eventarc.googleapis.com \
  run.googleapis.com pubsub.googleapis.com secretmanager.googleapis.com --project PROJECT_ID

You do not have to know this in advance — connect first, and the card prints exactly the lines your project still needs.

3. Choose the destination#

Destination Firestore Realtime Database Storage Shim
Europe (default) eur3 europe-west1 EU europe-west1
United States nam5 us-central1 US us-central1

The choice sets every location at once and cannot change once the Firestore database exists. A project that already has a database keeps its own location.

4. Connect and re-check#

Drop the JSON on the card and press Connect. The key is read in your browser, sent once and kept encrypted by the platform; the console shows only the service-account e-mail, the project id and the key id — never the key.

The card then shows a checklist (What gets set up). When something is missing it prints the fix; run it and press Re-check. Google applies new roles a few minutes after you grant them, so a Re-check straight after a grant may still read blocked. The card reads Connected when the data planes, the indexes and the shim are in place.

From then on the project wizard says "This project will be created in {space}'s own cloud" and new projects land there.