Rotating the key#
Upload a new key on the card replaces the credential in place (same Firebase project). Delete the old key in Google Cloud IAM afterwards — the card shows its id.
Revoking access#
You can remove the platform's access at any time in your IAM page. The cloud then reads Unreachable and its projects answer 503 org_unreachable; restore the key or its roles and Re-check. Nothing else is affected — tokens, the wallet and the plan stay.
Disconnecting#
Disconnect removes the key and the shim key from the platform's custody. It is refused while any project of the space still keeps data in the cloud (the card names the count). Nothing in your Firebase project is touched — delete the key and, if you like, the shim functions yourself.
Deleting a project in a cloud#
Deleting a project (a platform action) removes all of its data in your cloud: the project's documents and subcollections, its credits and coupons, the stock ledgers it owns, its payment records and its files. Access tokens, secrets and the team roster stay in place.
When something is wrong#
| The card says | Do |
|---|---|
Blocked · Firestore access, with a gcloud … roles/firebase.admin line |
grant the role, wait a few minutes, Re-check |
| "Create the Firestore database first" / "Creating the firestore" | wait for the platform's create, or create it in the console |
| A create or the shim deploy failed with "API … has not been used or is disabled" | run the printed gcloud services enable … line, Re-check |
| "The platform deploys the shim once the key holds the deploy roles" | grant roles/iam.serviceAccountUser, Re-check |
| "That project is already connected on the other environment" | use a separate Firebase project for this environment |
| Unreachable · key revoked / permission denied | upload a new key or restore the roles, Re-check |
Still stuck? Share the space id with the platform team — the status carries the probe's exact findings.