JEN PERSON: Hey, all you Python developers.
I'm Jen Person and I'm going to show you
how to generate auth tokens using the Firebase Admin SDK.
[UPBEAT MUSIC]
Firebase authentication has some great built-in options
for getting your users logged into your app,
such as email password and Google authentication.
But you also have the option to use your own authentication
scheme.
You may already be using an authentication scheme you like,
or it may be a requirement of your application
to use some specific form of authentication.
Firebase gives you complete control over authentication
by allowing you to authenticate users or devices using
secure JSON Web Tokens, pronounced "jot."
JWTs enable you to sign in with custom authentication methods
beyond those currently supported by default in Firebase.
One way to use JWTs is to generate them
on a secure server that you manage,
pass them back to the client device,
and then use them to authenticate the assign
and custom token method.
To achieve this, you must create a server endpoint
that accepts sign-in credentials, such as a username
and password and, if the credentials are valid,
returns a custom JWT.
The custom JWT returned from your server
can then be used by a client device
to authenticate with Firebase on iOS, Android, or web.
Once authenticated, the token can
be used for accessing other Firebase services,
such as Firebase Realtime Database and Cloud Storage.
Today I'll show you how to create a JWT using
the Admin SDK for Python.
But you can also create a JWT using the Admin
SDK for Java, Node.js, and Go.
Let's get started by adding and initializing the SDK.
First, I need service account credentials,
which I can download from the Firebase console.
Under the Firebase Admin SDK tab,
I'll select Generate new private key.
This downloads a JSON file containing the service account
credentials.
I'll add this to my projects directory.
I'm using Virtualenv, which is a tool that creates
isolated Python environments.
When I call it, Virtualenv creates
a folder with the given name.
I'll call it generate_tokens.
This folder contains the Python executable files
and a copy of the pip library, which you can
use to install other packages.
That way I can isolate the versions of Python
and packages per project.
I'll then use pip to install Firebase Admin,
and it will be installed in this virtual Python environment.
Now I'll create a new project.
I'm going to use PyCharm, but you can
use whatever IDE you prefer.
Note that for my interpreter, I'm
choosing the virtual environment I created
in the generate_tokens folder.
I'll create a new Python file.
OK, I'm going to need to import the required packages.
PyCharm includes a feature where it suggests imports.
So I'll leave off the imports for now.
I can initialize the SDK using my downloaded service account
key file like this.
Now you'll see I have a couple words in red here.
If I hover over them, PyCharm tells me there's
an unresolved reference.
I can also see a pop-up with a suggested import.
PyCharm can make the suggestion because I have the Firebase
admin package installed.
I'll use this shortcut to auto complete the import.
The Firebase Admin SDK provides a mechanism
for creating custom tokens.
These tokens expire after one hour.
But once you sign in a user using sign
in with custom token, they will remain signed into the device
until their session is invalidated
or the user signs out.
Tokens expire to prevent someone from authenticating forever
to the app once they logged in at least once.
You need to provide a UID, which can be any string that uniquely
identifies the user or device you are authenticating.
Once the token is returned to the client,
if the authentication succeeds, your user
will be now signed into your client app
with the account specified in the UID included in the custom
token.
If a Firebase account with the given UID
did not previously exist, a record for that user
will be created with the UID provided by the token.
You can also include claims, which
can customize what data the client can access.
I'll show you what that looks like, too,
using an iOS app I made that displays a special photo
and message to users who upgrade to premium content.
Let's get going on the code to create custom tokens.
So I'll now generate the custom token.
Since the UID can be any string, I'll
just make it some_UID for now.
If I had a known user, I'd want to use their UID here.
I'll use the create custom token from the Firebase Admin Auth
Module, which returns the token.
Finally, I'll print the custom token.
This token is signed with the private key present
in the service account credentials.
Now you also have the option to include claims
to the custom token.
Here I'm adding a premium account
to the custom token, which will be
available in the auth object in my database security rules,
and my request.auth object in my storage security rules.
Say I have some content in my database
that I want to restrict to only premium accounts.
I can allow access to that data by checking the premium account
claim in the security rules, like this.
I can store data in the database under a child called Premium
Content and enable read access to this child for any user
whose token allows it.
I can do something similar with Cloud Storage.
Here I'm using the premium account claim
to configure rules like this one,
restricting some files in Cloud Storage
to users with a premium account claim.
I've included some content in my database
and Cloud Storage that is only accessible if the auth tokens
premium account claim is set to true.
So first, let's run the function without the claim and then
with it, to see how access to the content
changes for the client.
To test my function, I'm going to run it, generate a UID,
and then use the resulting token to authenticate
in this simple iOS app I made.
And you can see a new user was created in the database.
I can also create a custom token from an existing UID
and sign-in from the client.
I'll copy the UID, paste it into my code where I had some_UID.
Now I'm signed in as this test user I made earlier.
But as you can see, I get a message
saying I need to sign up for a premium account
to see custom content.
If I go back to my code and include the claim premium
account and run my code again, I can use this custom token
to sign in.
And you can see content only visible to a premium account.
And there you have it.
Now you can create custom tokens that the client
can use to sign in and access Firebase features.
Remember to subscribe to the Firebase channel
to find out about the latest Firecasts and other Firebase
YouTube series, including my series, Ask Firebase.
I'll see you on a future episode of Firecasts.
[UPBEAT MUSIC]