Custom authentication tokens in Firebase - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a custom authentication token in Firebase?

A custom authentication token is a secure token created by your server to sign in users with Firebase Authentication when you want to manage your own user identities.

beginner

Why would you use custom authentication tokens instead of Firebase's built-in sign-in methods?

You use custom tokens when you have your own user system or want to integrate Firebase Authentication with existing authentication methods outside Firebase.

intermediate

Which Firebase Admin SDK method is used to create a custom authentication token?

The method is createCustomToken(uid, additionalClaims) where uid is the user ID and additionalClaims are optional extra data.

beginner

What information must you include when creating a custom authentication token?

You must include a unique user ID (uid) and can optionally add extra claims like roles or permissions.

beginner

How does a client use a custom authentication token to sign in?

The client receives the token from your server and calls signInWithCustomToken(token) to authenticate with Firebase.

What is the main purpose of Firebase custom authentication tokens?

A To replace Firebase Realtime Database

B To create Firebase projects

C To store user data securely

D To sign in users with your own authentication system integrated with Firebase

Custom tokens let you sign in users using your own authentication system with Firebase Authentication.

Which Firebase SDK is used to create custom authentication tokens?

A Firebase Storage SDK

B Firebase Admin SDK

C Firebase Client SDK

D Firebase Hosting SDK

The Firebase Admin SDK runs on your server and creates custom tokens.

What is required to create a custom token?

A User's email only

B User's password

C A unique user ID (uid)

D Firebase API key

A unique user ID (uid) identifies the user in the token.

How does the client authenticate with Firebase using a custom token?

A By calling signInWithCustomToken(token)

B By calling signInWithEmailAndPassword

C By calling createUserWithEmailAndPassword

D By calling signOut

The client uses signInWithCustomToken(token) to authenticate with the custom token.

Can you add extra information like user roles in a custom token?

A Yes, as additional claims

B No, tokens only contain user ID

C Yes, but only in the client SDK

D No, Firebase does not support extra data

You can add extra claims like roles or permissions when creating the token.

Explain how custom authentication tokens work in Firebase and why you might use them.

Think about how your server and client communicate to authenticate users.

Describe the steps to create and use a custom authentication token in Firebase.

Focus on server token creation and client sign-in.

Practice

1. What is the main purpose of Firebase custom authentication tokens?

easy

A. To store user data in Firebase Realtime Database

B. To sign in users from your own system to Firebase

C. To send notifications to users

D. To create Firebase projects automatically

Solution

1. Step 1: Understand the role of custom tokens

   Custom tokens are used to authenticate users from an external system with Firebase.

2. Step 2: Identify the correct purpose

   They allow users to sign in securely using tokens generated on your server.

3. Final Answer:

   To sign in users from your own system to Firebase -> Option B

4. Quick Check:

   Custom tokens = sign in users [OK]

Hint: Custom tokens = external user sign-in method [OK]

Common Mistakes:

• Confusing tokens with data storage
• Thinking tokens send notifications
• Assuming tokens create projects

2. Which Firebase Admin SDK method is used to create a custom authentication token?

easy

A. admin.auth().createCustomToken(uid)

B. admin.database().createToken(uid)

C. firebase.auth().signInWithCustomToken(uid)

D. admin.storage().generateToken(uid)

Solution

1. Step 1: Identify the correct Admin SDK service

   Custom tokens are created using the Authentication service, not database or storage.

2. Step 2: Match the correct method

   The method to create a custom token is createCustomToken(uid) under admin.auth().

3. Final Answer:

   admin.auth().createCustomToken(uid) -> Option A

4. Quick Check:

   Custom token creation = admin.auth().createCustomToken [OK]

Hint: Use admin.auth().createCustomToken to generate tokens [OK]

Common Mistakes:

• Using database or storage methods incorrectly
• Confusing signInWithCustomToken with token creation
• Calling methods on firebase instead of admin SDK

3. What will the following code output if uid is 'user123' and no errors occur?

const admin = require('firebase-admin');
admin.initializeApp();

admin.auth().createCustomToken('user123')
  .then(token => console.log(typeof token))
  .catch(error => console.error(error));

medium

A. 'object'

B. An error message

C. 'undefined'

D. 'string'

Solution

1. Step 1: Understand createCustomToken return type

   The method returns a Promise that resolves to a string token.

2. Step 2: Check console.log output

   Logging typeof token will print 'string' because the token is a string.

3. Final Answer:

   'string' -> Option D

4. Quick Check:

   createCustomToken returns string token [OK]

Hint: createCustomToken returns a string token inside a Promise [OK]

Common Mistakes:

• Expecting an object instead of string
• Confusing token with undefined
• Assuming an error without cause

4. Identify the error in this code snippet for generating a custom token:

const admin = require('firebase-admin');

admin.auth().createCustomToken('12345')
  .then(token => console.log(token))
  .catch(error => console.error(error));

medium

A. Missing admin.initializeApp() call

B. Incorrect method name, should be generateCustomToken

C. createCustomToken does not return a Promise

D. UID must be a string, not a number

Solution

1. Step 1: Check initialization of Firebase Admin SDK

   The admin SDK must be initialized with admin.initializeApp() before use.

2. Step 2: Verify other parts

   The UID '12345' is a valid string, createCustomToken returns a Promise, and method name is correct.

3. Final Answer:

   Missing admin.initializeApp() call -> Option A

4. Quick Check:

   Initialize admin SDK before calling methods [OK]

Hint: Always call admin.initializeApp() before using admin SDK [OK]

Common Mistakes:

• Passing number instead of string UID
• Assuming createCustomToken is synchronous
• Using wrong method name

5. You want to add extra user info like role: 'admin' in a custom token. Which code snippet correctly adds this claim?

hard

A. admin.auth().setCustomUserClaims(uid, { role: 'admin' })

B. admin.auth().createCustomToken(uid).setClaims({ role: 'admin' })

C. admin.auth().createCustomToken(uid, { role: 'admin' })

D. admin.auth().createCustomToken(uid, { claims: { role: 'admin' } })

Solution

1. Step 1: Understand how to add extra claims in custom tokens

   The createCustomToken method accepts a second argument with additional claims as a plain object.

2. Step 2: Evaluate each option

   admin.auth().createCustomToken(uid, { role: 'admin' }) correctly passes extra claims as second argument. admin.auth().createCustomToken(uid).setClaims({ role: 'admin' }) is invalid chaining. admin.auth().setCustomUserClaims(uid, { role: 'admin' }) sets claims on user but not in token creation. admin.auth().createCustomToken(uid, { claims: { role: 'admin' } }) nests claims incorrectly.

3. Final Answer:

   admin.auth().createCustomToken(uid, { role: 'admin' }) -> Option C

4. Quick Check:

   Extra claims go as second argument in createCustomToken [OK]

Hint: Pass extra claims as second argument to createCustomToken [OK]

Common Mistakes:

• Trying to chain setClaims on token creation
• Using setCustomUserClaims instead of token claims
• Nesting claims inside another object