firebase-auth-basics

## Prerequisites - **Firebase Project**: Created via `npx -y firebase-tools@latest projects:create` (see `firebase-basics`). - **Firebase CLI**: Installed and logged in (see `firebase-basics`). ## Core Concepts Firebase Authentication provides backend services, easy-to-use SDKs, and ready-made UI libraries to authenticate users to your app. ### Users A user is an entity that can sign in to your app. Each user is identified by a unique ID (`uid`) which is guaranteed to be unique across all providers. User properties include: - `uid`: Unique identifier. - `email`: User's email address (if available). - `displayName`: User's display name (if available). - `photoURL`: URL to user's photo (if available). - `emailVerified`: Boolean indicating if the email is verified. ### Identity Providers Firebase Auth supports multiple ways to sign in: - **Email/Password**: Basic email and password authentication. - **Federated Identity Providers**: Google, Facebook, Twitter, GitHub, Microsoft, Apple, etc. - **Phone Number**: SMS-based authentication. - **Anonymous**: Temporary guest accounts that can be linked to permanent accounts later. - **Custom Auth**: Integrate with your existing auth system. Google Sign In is recommended as a good and secure default provider. ### Tokens When a user signs in, they receive an ID Token (JWT). This token is used to identify the user when making requests to Firebase services (Realtime Database, Cloud Storage, Firestore) or your own backend. - **ID Token**: Short-lived (1 hour), verifies identity. - **Refresh Token**: Long-lived, used to get new ID tokens. ## Workflow ### 1. Provisioning #### Option 1. Enabling Authentication via CLI Only Google Sign In, anonymous auth, and email/password auth can be enabled via CLI. For other providers, use the Firebase Console. Configure Firebase Authentication in `firebase.json` by adding an 'auth' block: ``` { "auth": { "providers": { "anonymous": true, "emailPassword": true, "googleSignIn": { "oAuthBrandDisplayName": "Your Brand Name", "supportEmail": "support@example.com", "authorizedRedirectUris": [ "https://my-project-id.firebaseapp.com/__/auth/handler", "http://localhost" ] } } } } ``` > [!NOTE] If the Google Sign-In popup opens and immediately closes with the > error `[firebase_auth/unauthorized-domain]`, it means the domain is not > authorized. For local development, add `http://localhost` to > `authorizedRedirectUris` in `firebase.json` (or ensure `localhost` is included > in the **Authorized Domains** list in the Firebase Console under > Authentication > Settings > Authorized domains). **CRITICAL**: Do NOT include > the port number in `authorizedRedirectUris` (e.g., use `http://localhost`, NOT > `http://localhost:9090` or `http://localhost:4000`), and do NOT include the > protocol or port number in the Console Authorized Domains list (use > `localhost`). Including a port number in `authorizedRedirectUris` causes > `firebase deploy --only auth` to fail with `INVALID_AUTHORIZED_DOMAIN`. **CRITICAL**: After configuring `firebase.json`, you MUST deploy the auth configuration to the Firebase backend for the changes to take effect. This is essential for auth providers like Google Sign-In, email/password, etc. to auto-generate the necessary OAuth clients for your app platforms. Run: ```bash npx -y firebase-tools@latest deploy --only auth ``` #### Option 2. Enabling Authentication in Console Enable other providers in the Firebase Console. 1. Go to the https://console.firebase.google.com/project/_/authentication/providers 1. Select your project. 1. Enable the desired Sign-in providers (e.g., Email/Password, Google). ### 2. Client Setup & Usage **Web** See [references/client_sdk_web.md](references/client_sdk_web.md). **Flutter** See [references/flutter_setup.md](references/flutter_setup.md). **Android (Kotlin)** See [references/client_sdk_android.md](references/client_sdk_android.md). **iOS (Swift)** See [references/ios_setup.md](references/ios_setup.md). ### 3. Security Rules Secure your data using `request.auth` in Firestore/Storage rules. See [references/security_rules.md](references/security_rules.md).