JEN PERSON: Hey, all you Go developers.
I'm Jen Person, and I'm going to show you
how to generate auth tokens using the Firebase Admin SDK.
[MUSIC PLAYING]
Firebase authentication has some great built-in options
for getting your users logged into your app,
such as email and password, and Google authentication.
But you also have the option to use your own custom
authentication scheme.
You may already be using an authentication scheme you like,
or it may be a requirement of your application
to use some specific form of authentication.
Firebase gives you complete control over authentication
by allowing you to authenticate users or devices using
secure JSON Web Tokens, pronounced "jot."
JWTs enable you to sign in with custom authentication methods
beyond those currently supported by default in Firebase.
One way to use JWTs is to generate them
on a secure server that you manage,
pass them back to the client device,
and then use them to authenticate via sign
and custom token method.
To achieve this, you must create a server endpoint that
accepts sign-in credentials, such as a username
and password, and if the credentials are valid,
returns a custom JWT.
The custom JWT returned from your server
can then be used by a client device
to authenticate with Firebase on iOS, Android, or web.
Once authenticated, the token can
be used for accessing other Firebase services,
such as Firebase Realtime Database and cloud storage.
Today, I'll show you how to create a JWT using the Admin
SDK for Go.
But you can also create a JWT using the Admin SDK
for Java, Node.js, and Python.
Let's get started by adding and initializing the SDK.
[MUSIC PLAYING]
First, I need service account credentials,
which I can download from the Firebase console.
Under the Firebase Admin SDK tab,
I'll select Generate New Private Key.
This downloads a JSON file containing the service account
credentials.
I'll add this to my project's directory.
Then I'll use the Go Get utility to install the Go Admin SDK.
Once that's in place, I'll import the required packages
to main.go.
Then I can initialize the SDK using my downloaded service
account key file.
If the initialization is successful,
I can use the app object.
If an error is returned, I'll handle it here.
[MUSIC PLAYING]
The Firebase Admin SDK provides a mechanism
for creating custom tokens.
These tokens expire after one hour.
But once you sign in a user using Sign
in with Custom Token, they will remain signed into the device
until their session is invalidated
or the user signs out.
Tokens expire to prevent someone from authenticating forever
to the app once they logged in at least once.
You need to provide a UID, which can be any string that uniquely
identifies the user or device you are authenticating.
Once the token is returned to the client,
if the authentication succeeds, your user
will be now signed into your client app
with the account specified in the UID included in the custom
token.
If a Firebase account with a given UID
do not previously exist, a record for that user
will be created with the UID provided by the token.
You can also include claims, which
can customize what data the client can access.
I'll show you what that looks like too,
using an iOS app I made that displays a special photo
and message to users who upgrade to premium content.
Let's get going on the code to create custom tokens.
[MUSIC PLAYING]
Using my initialized app object, I
can call app.off to get an instance
of auth client or an error.
If there's an error, I'll print it and return.
Client is the interface for the Firebase Auth service.
It facilitates generating custom JWTs for Firebase clients,
and verifying ID tokens issued by Firebase back end services.
So I'll now use Client to generate a custom token.
Since the UID can be any string, I'll just make it "some-uid"
for now.
If an error is returned, I'll handle it.
For the sake of this example, I'll just
print the error and return.
Finally, I'll print the custom token.
This token is signed with a private key present
in the service account credentials.
Now, you also have the option to include claims
to the custom token.
Here, I'm adding premium account to the custom token, which
will be available in the auth object in my database security
rules and my request auth object in my stored security rules.
[MUSIC PLAYING]
Say I have some content in my database
that I want to restrict to only premium accounts.
I can allow access to that data by checking the premium account
claim in the security rules, like this.
I can store data in the database under a child called premium
content, and enable read access to this child for any user
whose token allows it.
I can do something similar with cloud storage.
Here, I'm using the premium account
claimed to configure rules like this one,
restricting some files in cloud storage
to users with a premium account claim.
I've included some content in my database and cloud storage that
is only accessible if the auth token's premium account
claim is set to true.
So first, let's run the function without the claim and then
with it to see how access to the content changes for the client.
[MUSIC PLAYING]
To test my function, I'm going to run it, generate a UID,
and then use the resulting token to authenticate
in this simple iOS app I made.
And you can see a new user was created in the database.
I can also create a custom token from an existing UID
and sign-in from the client.
I'll copy the UID, paste it into my code, where I had some-uid.
Now, I'm signed in as this test user I made earlier.
But as you can see, I get a message
saying I need to sign up for a premium account
to see custom content.
If I go back to my code and include the claim premium
account and run my code again, I can use this custom token
to sign in, and you can see content only
visible to a premium account.
[MUSIC PLAYING]
There you have it.
Now you can create custom tokens that the client
can use to sign in and access Firebase features.
Remember to subscribe to the Firebase channel
to find out about the latest "Firecasts" and other Firebase
YouTube series, including my series, "Ask Firebase."
I'll see you on a future episode of "Firecasts."
[MUSIC PLAYING]