I’m working on a similar setup with Firebase Auth + callable functions from Flutter.

Thanks for sharing your IAM config in detail, it helps clarify what the limits of Firebase v2 callable functions are compared to v1. I’m wondering if you’ve tried using App Check or another token-based identity for Cloud Run?