$npx -y skills add firebase/agent-skills --skill firebase-auth-basicsGuide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.
| 1 | ## Prerequisites |
| 2 | |
| 3 | - **Firebase Project**: Created via |
| 4 | `npx -y firebase-tools@latest projects:create` (see `firebase-basics`). |
| 5 | - **Firebase CLI**: Installed and logged in (see `firebase-basics`). |
| 6 | |
| 7 | ## Core Concepts |
| 8 | |
| 9 | Firebase Authentication provides backend services, easy-to-use SDKs, and |
| 10 | ready-made UI libraries to authenticate users to your app. |
| 11 | |
| 12 | ### Users |
| 13 | |
| 14 | A user is an entity that can sign in to your app. Each user is identified by a |
| 15 | unique ID (`uid`) which is guaranteed to be unique across all providers. User |
| 16 | properties include: |
| 17 | |
| 18 | - `uid`: Unique identifier. |
| 19 | - `email`: User's email address (if available). |
| 20 | - `displayName`: User's display name (if available). |
| 21 | - `photoURL`: URL to user's photo (if available). |
| 22 | - `emailVerified`: Boolean indicating if the email is verified. |
| 23 | |
| 24 | ### Identity Providers |
| 25 | |
| 26 | Firebase Auth supports multiple ways to sign in: |
| 27 | |
| 28 | - **Email/Password**: Basic email and password authentication. |
| 29 | - **Federated Identity Providers**: Google, Facebook, Twitter, GitHub, |
| 30 | Microsoft, Apple, etc. |
| 31 | - **Phone Number**: SMS-based authentication. |
| 32 | - **Anonymous**: Temporary guest accounts that can be linked to permanent |
| 33 | accounts later. |
| 34 | - **Custom Auth**: Integrate with your existing auth system. |
| 35 | |
| 36 | Google Sign In is recommended as a good and secure default provider. |
| 37 | |
| 38 | ### Tokens |
| 39 | |
| 40 | When a user signs in, they receive an ID Token (JWT). This token is used to |
| 41 | identify the user when making requests to Firebase services (Realtime Database, |
| 42 | Cloud Storage, Firestore) or your own backend. |
| 43 | |
| 44 | - **ID Token**: Short-lived (1 hour), verifies identity. |
| 45 | - **Refresh Token**: Long-lived, used to get new ID tokens. |
| 46 | |
| 47 | ## Workflow |
| 48 | |
| 49 | ### 1. Provisioning |
| 50 | |
| 51 | #### Option 1. Enabling Authentication via CLI |
| 52 | |
| 53 | Only Google Sign In, anonymous auth, and email/password auth can be enabled via |
| 54 | CLI. For other providers, use the Firebase Console. |
| 55 | |
| 56 | Configure Firebase Authentication in `firebase.json` by adding an 'auth' block: |
| 57 | |
| 58 | ``` |
| 59 | { |
| 60 | "auth": { |
| 61 | "providers": { |
| 62 | "anonymous": true, |
| 63 | "emailPassword": true, |
| 64 | "googleSignIn": { |
| 65 | "oAuthBrandDisplayName": "Your Brand Name", |
| 66 | "supportEmail": "support@example.com", |
| 67 | "authorizedRedirectUris": ["https://example.com", "http://localhost"] |
| 68 | } |
| 69 | } |
| 70 | } |
| 71 | } |
| 72 | ``` |
| 73 | |
| 74 | > [!NOTE] If the Google Sign-In popup opens and immediately closes with the |
| 75 | > error `[firebase_auth/unauthorized-domain]`, it means the domain is not |
| 76 | > authorized. For local development, ensure `localhost` is included in the |
| 77 | > **Authorized Domains** list in the Firebase Console or via the |
| 78 | > `authorizedDomains` field in `firebase.json`. **CRITICAL**: Do NOT include the |
| 79 | > protocol or port number in the Authorized Domains list (e.g., use `localhost`, |
| 80 | > NOT `http://localhost:9090`). |
| 81 | |
| 82 | **CRITICAL**: After configuring `firebase.json`, you MUST deploy the auth |
| 83 | configuration to the Firebase backend for the changes to take effect. This is |
| 84 | essential for auth providers like Google Sign-In, email/password, etc. to |
| 85 | auto-generate the necessary OAuth clients for your app platforms. Run: |
| 86 | |
| 87 | ```bash |
| 88 | npx -y firebase-tools@latest deploy --only auth |
| 89 | ``` |
| 90 | |
| 91 | #### Option 2. Enabling Authentication in Console |
| 92 | |
| 93 | Enable other providers in the Firebase Console. |
| 94 | |
| 95 | 1. Go to the |
| 96 | https://console.firebase.google.com/project/_/authentication/providers |
| 97 | 1. Select your project. |
| 98 | 1. Enable the desired Sign-in providers (e.g., Email/Password, Google). |
| 99 | |
| 100 | ### 2. Client Setup & Usage |
| 101 | |
| 102 | **Web** See [references/client_sdk_web.md](references/client_sdk_web.md). |
| 103 | |
| 104 | **Flutter** See [references/flutter_setup.md](references/flutter_setup.md). |
| 105 | **Android (Kotlin)** See |
| 106 | [references/client_sdk_android.md](references/client_sdk_android.md). |
| 107 | |
| 108 | ### 3. Security Rules |
| 109 | |
| 110 | Secure your data using `request.auth` in Firestore/Storage rules. |
| 111 | |
| 112 | See [references/security_rules.md](references/security_rules.md). |