A Firebase project often holds a client's whole app backend: sign-in, database, file storage, hosting and functions. With your own seat on it, you build and deploy from your own Google Account while the client stays the Owner, keeps the billing, and can remove you whenever the work ends. This guide follows Theo at Northside Studio, who is building the Harbor Coach app for Dana at Harbor Fitness.
Console labels come from Google's Firebase and Google Cloud documentation at the time of writing.
Get Set Keys sends your client one link for Firebase and Google Cloud, with your email and the right role already filled in, and checks each step is done.
Send one link insteadFirebase members are Google Cloud members
When someone creates a Firebase project, Google creates a Google Cloud project behind the scenes. According to Firebase's project guide, IAM roles and permissions are shared across both, so any access a member has in Google Cloud also applies in Firebase. Billing is shared too, and deleting the project deletes it in both places.
That gives Dana two places to manage people:
- The Firebase console, under Users and permissions, is the simple view. It lists members with a basic role (Owner, Editor or Viewer) or a Firebase role, and leaves out service accounts.
- The Google Cloud console, under IAM & Admin > IAM, lists everyone. Google Cloud calls members principals, and narrower Google Cloud roles are added here.
Skip the back and forth. Let one link walk your client through it
The roles that fit an agency
| Role | What it can do | Good for agencies? |
|---|---|---|
| Firebase Admin | Full read and write access to all Firebase services, including installing Extensions | Yes, for most Firebase builds |
| Editor | Everything a Viewer can do, plus creating, changing and deleting most resources across Firebase and Google Cloud | Yes, when the build goes beyond Firebase |
| Owner | Everything an Editor can do, plus managing members and roles, setting up billing, and deleting or restoring the project | Rarely |
| Viewer | Sees resources and data without changing anything | Yes, for support after launch |
Editor reaches across most Google Cloud services in the project, not only Firebase. Google Cloud's roles overview notes that basic roles carry thousands of permissions and advises against granting them in production when a narrower role will do. So if the work stays inside Firebase, ask for Firebase Admin. If the build also uses Google Cloud services outside Firebase, Editor is the practical choice.
One link per client, with every step checked. Reserve a founding place
Where the client adds you
- In the Firebase console, Dana opens the Harbor Coach project, clicks the gear icon (Settings) and opens Users and permissions.
- She clicks Add member and enters the email address of Theo's Google Account.
- She chooses Firebase Admin, or Editor if the build reaches beyond Firebase, then clicks Add.
Access changes can take several minutes to apply. The Firebase console offers the basic roles, Firebase Admin and Viewer, and Firebase's product-category roles. The exact clicks are also on our Firebase step by step and Google Cloud step by step pages.
Get Set KeysOne link per client
With one link, Dana sees these steps with your email and the Firebase Admin role already filled in, a one-click Google sign-in checks the step, and reminders go out on their own.
Send one link insteadLaunching November 2026
Extra roles for deploying Cloud Functions
Deploying functions is a job Firebase Admin can't do on its own. Firebase says it needs permissions that the standard Firebase predefined roles don't include, and it offers three options:
- A project Owner deploys the functions.
- An Editor deploys them, as long as none are HTTP functions.
- A member with both Cloud Functions Admin and Service Account User deploys them.
Harbor Coach uses HTTP functions, so Theo asks for the third option rather than Owner. Dana adds both roles in the Google Cloud console. She opens IAM & Admin > IAM and selects the project. Theo already has a role, so she clicks Edit principal on his row, clicks Add another role, picks Cloud Functions Admin under Select a role, adds Service Account User the same way, then clicks Save. For someone with no role yet, she starts from Grant Access instead.
Sending this to a client? Send one link instead
Why Owner is rarely needed
Owner adds three powers to Editor: managing members and roles, setting up billing, and deleting or restoring the project. An agency needs none of them to build. Owners also receive Google's notices about billing, legal changes and feature deprecations, which belong with the business that pays.
Firebase's basic roles page says every project must have an Owner, and Owners are often the only members who can do administrative tasks. That person should be Dana, not the agency. If a task truly needs Owner, ask for it for that task and step back down afterward. When Dana grants Owner, Firebase sends an invitation, and the member shows as pending until they accept.
Skip the back and forth. Let one link walk your client through it
Two-step verification on Google Accounts
Google is phasing in a 2-Step Verification requirement for the Firebase console and the Google Cloud console. Once it applies to an account, anyone without 2-Step Verification is asked to set it up before the console opens. Theo should turn it on before Dana's invite arrives, so his first sign-in goes smoothly. Deployed apps aren't affected.
One link per client, with every step checked. Reserve a founding place
Removing access at the end
- In the Firebase console, Dana opens Users and permissions, ticks the box next to Theo's email and clicks Remove member.
- In the Google Cloud console, she checks IAM & Admin > IAM for anything the Firebase console doesn't show, such as the function deploy roles or service accounts the agency set up. For a leftover role, she clicks Edit principal on that row, clicks Delete next to each role, then clicks Save.
- She deletes any service account keys the agency used for deploys.
- If the project is billed to your agency's Cloud Billing account, move it to Dana's: in the Google Cloud console's Billing section, open My projects, then the project's Actions menu and Change billing. The person making the switch needs billing permissions on both accounts, so plan it together before your access ends.
If Northside Studio created the project and holds the Owner role, Theo makes Dana an Owner first, waits until she accepts the invitation, and only then removes himself. Our project handover checklist covers the same clean-up for the client's other platforms.
- Dana holds the Owner role
- Theo removed under Users and permissions
- no agency roles left on the IAM page
- service account keys the agency used deleted
- project billed to the Harbor Fitness Cloud Billing account
Get Set KeysOne link per client
When the project ends, a handover link shows Dana how to remove your account from Harbor Coach, with your email already filled in, so access goes back to her.
Send one link insteadLaunching November 2026
Doing this for every client?
Get Set Keys gives each client one link that walks them through these Firebase steps and checks each one is done. Porter, the AI setup helper on every link, answers their questions straight away and passes anything it can't answer to you. You can reserve a founding place before launch in November 2026.