Generated banner for Firebase Auth Basics
Generated logo for Firebase Auth Basics

Firebase Auth Basics

Firebase (Google)OfficialCreated by Google LLCDistributed by Firebase (Google)

  • Skill
  • Tool integration
  • Cloud and DevOps
  • Apache-2.0
  • Low risk

From the author

Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.
— the description by Google LLC

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a foundational guide for implementing Firebase Authentication, covering core concepts like user identification, identity providers, and token management. It outlines the necessary steps for provisioning authentication services via the Firebase CLI or Console and provides integration patterns for various client platforms including Web, Android, iOS, and Flutter. It also addresses critical configuration requirements such as authorized domains and security rule integration.

What it does

  • Explains core Firebase Auth concepts including UIDs, identity providers, and JWT tokens.
  • Provides procedures for enabling authentication providers via the Firebase CLI and Console.
  • Offers guidance on configuring authorized domains to prevent common OAuth errors.
  • Details client-side initialization patterns for Web and Android platforms.
  • Outlines the use of security rules to protect data access based on user authentication state.

When to use it

  • When you need to implement user sign-in and management in a new or existing application.
  • When you need to secure your Firestore or Cloud Storage data using authentication rules.
  • When you are setting up federated identity providers like Google, Facebook, or Apple.
  • When you need to troubleshoot authentication domain authorization issues.

Advantages

  • Supports multiple authentication methods including email, social providers, and anonymous access.
  • Provides a unified identity model across different client platforms.
  • Includes clear instructions for avoiding common configuration pitfalls like port-related domain errors.
  • Integrates directly with other Firebase services for secure data access.

Usage examples

“How do I enable Google Sign-In for my Firebase project using the CLI?”
The agent will provide the structure for the auth block in firebase.json and the command to deploy the configuration.
“How do I initialize Firebase Auth in an Android Kotlin app?”
The agent will provide the Gradle dependency setup and the code snippet for initializing the FirebaseAuth instance in an Activity.
“I am getting an auth/unauthorized-domain error, how do I fix it?”
The agent will explain how to add your domain to the Authorized Domains list in the Firebase Console without including protocol or port numbers.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/firebase/firebase-auth-basics/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip firebase-auth-basics.zip -d .agents/skills

Documentation by Google LLC

Prerequisites

  • Firebase Project: Created via npx -y firebase-tools@latest projects:create (see firebase-basics).

  • Firebase CLI: Installed and logged in (see firebase-basics).

Core Concepts

Firebase Authentication provides backend services, easy-to-use SDKs, and ready-made UI libraries to authenticate users to your app.

Users

A user is an entity that can sign in to your app. Each user is identified by a unique ID (uid) which is guaranteed to be unique across all providers. User properties include:

  • uid: Unique identifier.

  • email: User's email address (if available).

  • displayName: User's display name (if available).

  • photoURL: URL to user's photo (if available).

  • emailVerified: Boolean indicating if the email is verified.

Identity Providers

Firebase Auth supports multiple ways to sign in:

  • Email/Password: Basic email and password authentication.

  • Federated Identity Providers: Google, Facebook, Twitter, GitHub, Microsoft, Apple, etc.

  • Phone Number: SMS-based authentication.

  • Anonymous: Temporary guest accounts that can be linked to permanent accounts later.

  • Custom Auth: Integrate with your existing auth system.

Google Sign In is recommended as a good and secure default provider.

Tokens

When a user signs in, they receive an ID Token (JWT). This token is used to identify the user when making requests to Firebase services (Realtime Database, Cloud Storage, Firestore) or your own backend.

  • ID Token: Short-lived (1 hour), verifies identity.

  • Refresh Token: Long-lived, used to get new ID tokens.

Workflow

1. Provisioning
Option 1. Enabling Authentication via CLI

Only Google Sign In, anonymous auth, and email/password auth can be enabled via CLI. For other providers, use the Firebase Console.

Configure Firebase Authentication in firebase.json by adding an 'auth' block:

{
  "auth": {
    "providers": {
      "anonymous": true,
      "emailPassword": true,
      "googleSignIn": {
        "oAuthBrandDisplayName": "Your Brand Name",
        "supportEmail": "[email protected]",
        "authorizedRedirectUris": [
          "https://my-project-id.firebaseapp.com/__/auth/handler",
          "http://localhost"
        ]
      }
    }
  }
}

[!NOTE] If the Google Sign-In popup opens and immediately closes with the error [firebase_auth/unauthorized-domain], it means the domain is not authorized. For local development, add http://localhost to authorizedRedirectUris in firebase.json (or ensure localhost is included in the Authorized Domains list in the Firebase Console under Authentication > Settings > Authorized domains). CRITICAL: Do NOT include the port number in authorizedRedirectUris (e.g., use http://localhost, NOT http://localhost:9090 or http://localhost:4000), and do NOT include the protocol or port number in the Console Authorized Domains list (use localhost). Including a port number in authorizedRedirectUris causes firebase deploy --only auth to fail with INVALID_AUTHORIZED_DOMAIN.

CRITICAL: After configuring firebase.json, you MUST deploy the auth configuration to the Firebase backend for the changes to take effect. This is essential for auth providers like Google Sign-In, email/password, etc. to auto-generate the necessary OAuth clients for your app platforms. Run:

npx -y firebase-tools@latest deploy --only auth
Option 2. Enabling Authentication in Console

Enable other providers in the Firebase Console.

  1. Go to the https://console.firebase.google.com/project/_/authentication/providers

  2. Select your project.

  3. Enable the desired Sign-in providers (e.g., Email/Password, Google).

2. Client Setup & Usage

Web See references/client_sdk_web.md.

Flutter See references/flutter_setup.md. Android (Kotlin) See references/client_sdk_android.md.

iOS (Swift) See references/ios_setup.md.

3. Security Rules

Secure your data using request.auth in Firestore/Storage rules.

See references/security_rules.md.

Files

references/client_sdk_web.md

Firebase Authentication Web SDK

Initialization

First, ensure you have initialized the Firebase App (see firebase-basics skill). Then, initialize the Auth service:

import { getAuth } from "firebase/auth";
import { app } from "./firebase"; // Your initialized Firebase App

const auth = getAuth(app);
export { auth };

Connect to Emulator

If you are running the Authentication emulator (usually on port 9099), connect to it immediately after initialization.

import { getAuth, connectAuthEmulator } from "firebase/auth";

const auth = getAuth();
// Connect to emulator if running locally
if (location.hostname === "localhost") {
  connectAuthEmulator(auth, "http://localhost:9099");
}

Sign Up with Email/Password

import { getAuth, createUserWithEmailAndPassword } from "firebase/auth";

const auth = getAuth();
createUserWithEmailAndPassword(auth, email, password)
  .then((userCredential) => {
    const user = userCredential.user;
    // ...
  })
  .catch((error) => {
    const errorCode = error.code;
    const errorMessage = error.message;
    // ..
  });

Sign In with Google (Popup)

import { getAuth, signInWithPopup, GoogleAuthProvider } from "firebase/auth";

const auth = getAuth();
const provider = new GoogleAuthProvider();

signInWithPopup(auth, provider)
  .then((result) => {
    // This gives you a Google Access Token. You can use it to access the Google API.
    const credential = GoogleAuthProvider.credentialFromResult(result);
    const token = credential.accessToken;
    // The signed-in user info.
    const user = result.user;
    // ...
  })
  .catch((error) => {
    // Handle Errors here.
    const errorCode = error.code;
    const errorMessage = error.message;
    // ...
  });

[!IMPORTANT] Troubleshooting auth/unauthorized-domain: If the popup opens and immediately closes with error [firebase_auth/unauthorized-domain], it means the domain hosting your app is not authorized for OAuth operations in your Firebase project.

  • Fix: Add your domain (e.g., localhost for local testing) to the Authorized Domains list in the Firebase Console (Authentication > Settings > Authorized domains).

  • CRITICAL: Do NOT include the protocol or port number when adding the domain (e.g., use localhost, NOT http://localhost:9090).

Sign In with Facebook (Popup)

import { getAuth, signInWithPopup, FacebookAuthProvider } from "firebase/auth";

const auth = getAuth();
const provider = new FacebookAuthProvider();

signInWithPopup(auth, provider)
  .then((result) => {
    // The signed-in user info.
    const user = result.user;
    // This gives you a Facebook Access Token. You can use it to access the Facebook API.
    const credential = FacebookAuthProvider.credentialFromResult(result);
    const accessToken = credential.accessToken;
  })
  .catch((error) => {
    // Handle Errors here.
  });

Sign In with Apple (Popup)

import { getAuth, signInWithPopup, OAuthProvider } from "firebase/auth";

const auth = getAuth();
const provider = new OAuthProvider('apple.com');

signInWithPopup(auth, provider)
  .then((result) => {
    const user = result.user;
    // Apple credential
    const credential = OAuthProvider.credentialFromResult(result);
    const accessToken = credential.accessToken;
  })
  .catch((error) => {
    // Handle Errors here.
  });

Sign In with Twitter (Popup)

import { getAuth, signInWithPopup, TwitterAuthProvider } from "firebase/auth";

const auth = getAuth();
const provider = new TwitterAuthProvider();

signInWithPopup(auth, provider)
  .then((result) => {
    const user = result.user;
    // Twitter credential
    const credential = TwitterAuthProvider.credentialFromResult(result);
    const token = credential.accessToken;
    const secret = credential.secret;
  })
  .catch((error) => {
    // Handle Errors here.
  });

Sign In with GitHub (Popup)

import { getAuth, signInWithPopup, GithubAuthProvider } from "firebase/auth";

const auth = getAuth();
const provider = new GithubAuthProvider();

signInWithPopup(auth, provider)
  .then((result) => {
    const user = result.user;
    const credential = GithubAuthProvider.credentialFromResult(result);
    const token = credential.accessToken;
  })
  .catch((error) => {
    // Handle Errors here.
  });

Sign In with Microsoft (Popup)

import { getAuth, signInWithPopup, OAuthProvider } from "firebase/auth";

const auth = getAuth();
const provider = new OAuthProvider('microsoft.com');

signInWithPopup(auth, provider)
  .then((result) => {
    const user = result.user;
    const credential = OAuthProvider.credentialFromResult(result);
    const accessToken = credential.accessToken;
  })
  .catch((error) => {
    // Handle Errors here.
  });

Sign In with Yahoo (Popup)

import { getAuth, signInWithPopup, OAuthProvider } from "firebase/auth";

const auth = getAuth();
const provider = new OAuthProvider('yahoo.com');

signInWithPopup(auth, provider)
  .then((result) => {
    const user = result.user;
    const credential = OAuthProvider.credentialFromResult(result);
    const accessToken = credential.accessToken;
  })
  .catch((error) => {
    // Handle Errors here.
  });

Sign In Anonymously

import { getAuth, signInAnonymously } from "firebase/auth";

const auth = getAuth();
signInAnonymously(auth)
  .then(() => {
    // Signed in..
  })
  .catch((error) => {
    const errorCode = error.code;
    const errorMessage = error.message;
  });

1. Send Auth Link

import { getAuth, sendSignInLinkToEmail } from "firebase/auth";

const auth = getAuth();
const actionCodeSettings = {
  // URL you want to redirect back to. The domain must be in the authorized domains list in Firebase Console.
  url: 'https://www.example.com/finishSignUp?cartId=1234',
  handleCodeInApp: true,
};

sendSignInLinkToEmail(auth, email, actionCodeSettings)
  .then(() => {
    // Save the email locally so you don't need to ask the user for it again
    window.localStorage.setItem('emailForSignIn', email);
  })
  .catch((error) => {
    // Error
  });

2. Complete Sign In (on landing page)

import { getAuth, isSignInWithEmailLink, signInWithEmailLink } from "firebase/auth";

const auth = getAuth();

if (isSignInWithEmailLink(auth, window.location.href)) {
  let email = window.localStorage.getItem('emailForSignIn');
  if (!email) {
    email = window.prompt('Please provide your email for confirmation');
  }

  signInWithEmailLink(auth, email, window.location.href)
    .then((result) => {
      window.localStorage.removeItem('emailForSignIn');
      // You can check result.user
    })
    .catch((error) => {
      // Error
    });
}

Observe Auth State

Recommended way to get the current user. This listener triggers whenever the user signs in or out.

import { getAuth, onAuthStateChanged } from "firebase/auth";

const auth = getAuth();
onAuthStateChanged(auth, (user) => {
  if (user) {
    // User is signed in, see docs for a list of available properties
    // https://firebase.google.com/docs/reference/js/firebase.User
    const uid = user.uid;
    // ...
  } else {
    // User is signed out
    // ...
  }
});

Sign Out

import { getAuth, signOut } from "firebase/auth";

const auth = getAuth();
signOut(auth).then(() => {
  // Sign-out successful.
}).catch((error) => {
  // An error happened.
});

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Node.js

The author says: This skill is best used with the Firebase CLI, but does not require it. Firebase CLI can be accessed through `npx -y firebase-tools@latest`.

Security

What our scanner noticed· Low risk

  • Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Google LLC
Publisher
Firebase (Google) (Official)
Distributed by
Firebase (Google)
Source
firebase/agent-skills · skills/firebase-auth-basics · commit b76be96
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Google LLC or Firebase (Google).

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download firebase-auth-basics.zip