Custom authentication tokens in Firebase - Step-by-Step Execution

Process Flow - Custom authentication tokens

Create user identity info

↓

Generate custom token with secret key

↓

Send token to client app

↓

Client app uses token to sign in

↓

Firebase verifies token signature

↓

User authenticated and session started

This flow shows how a custom token is created, sent to the client, and used to authenticate a user in Firebase.

Execution Sample

Firebase

const token = await admin.auth().createCustomToken(uid);
// Send token to client
// Client signs in with token
// Firebase verifies and authenticates user

This code generates a custom token for a user ID, which the client uses to sign in securely.

Process Table

Step	Action	Input	Output	Notes
1	Create user identity info	uid='user123'	User info object with uid	Prepare user data for token
2	Generate custom token	User info + secret key	Custom JWT token string	Token signed with Firebase secret
3	Send token to client	Custom token string	Token received by client app	Client ready to authenticate
4	Client signs in	Custom token	Sign-in request to Firebase	Client uses token to authenticate
5	Firebase verifies token	Sign-in request	Verification success or failure	Checks token signature and claims
6	User authenticated	Verification success	User session started	User now logged in
7	Exit	N/A	N/A	Process complete

💡 User session started after successful token verification

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	Final
uid	undefined	'user123'	'user123'	'user123'	'user123'	'user123'	'user123'
customToken	undefined	undefined	JWT token string	JWT token string	JWT token string	JWT token string	JWT token string
userSession	undefined	undefined	undefined	undefined	undefined	undefined	active session

Key Moments - 3 Insights

Why do we need to create a custom token instead of using a password?

Custom tokens let you authenticate users with your own system securely, as shown in step 2 and 5 where the token is generated and verified.

What happens if the token verification fails?

If verification fails at step 5, Firebase rejects sign-in and no user session starts, preventing unauthorized access.

Can the client generate the custom token?

No, only trusted servers generate tokens (step 2) because they need the secret key to sign tokens securely.

Visual Quiz - 3 Questions

Look at the execution table, what is the output of step 2?

A Custom JWT token string

B Token received by client app

C User info object with uid

D User session started

💡 Hint

Check the 'Output' column in step 2 of the execution table.

At which step does Firebase verify the token signature?

A Step 4

B Step 5

C Step 3

D Step 6

💡 Hint

Look for the step where 'Firebase verifies token' in the 'Action' column.

If the client never receives the token, which step will fail next?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Without the token at client, sign-in (step 4) cannot proceed.

Concept Snapshot

Custom authentication tokens let you securely sign in users with your own system.
Generate a token on your server using a user ID and secret key.
Send the token to the client app.
Client uses token to sign in with Firebase.
Firebase verifies token and starts user session.
This allows custom user authentication beyond passwords.

Full Transcript

Custom authentication tokens in Firebase allow you to authenticate users using tokens you create on your server. First, you prepare user identity information like a user ID. Then, your server generates a signed token using Firebase's secret key. This token is sent to the client app, which uses it to sign in with Firebase. Firebase verifies the token's signature and claims to ensure it is valid. If verification succeeds, Firebase starts a user session and the user is authenticated. This process lets you integrate your own authentication system securely with Firebase.

Practice

1. What is the main purpose of Firebase custom authentication tokens?

easy

A. To store user data in Firebase Realtime Database

B. To sign in users from your own system to Firebase

C. To send notifications to users

D. To create Firebase projects automatically

Solution

1. Step 1: Understand the role of custom tokens

   Custom tokens are used to authenticate users from an external system with Firebase.

2. Step 2: Identify the correct purpose

   They allow users to sign in securely using tokens generated on your server.

3. Final Answer:

   To sign in users from your own system to Firebase -> Option B

4. Quick Check:

   Custom tokens = sign in users [OK]

Hint: Custom tokens = external user sign-in method [OK]

Common Mistakes:

• Confusing tokens with data storage
• Thinking tokens send notifications
• Assuming tokens create projects

2. Which Firebase Admin SDK method is used to create a custom authentication token?

easy

A. admin.auth().createCustomToken(uid)

B. admin.database().createToken(uid)

C. firebase.auth().signInWithCustomToken(uid)

D. admin.storage().generateToken(uid)

Solution

1. Step 1: Identify the correct Admin SDK service

   Custom tokens are created using the Authentication service, not database or storage.

2. Step 2: Match the correct method

   The method to create a custom token is createCustomToken(uid) under admin.auth().

3. Final Answer:

   admin.auth().createCustomToken(uid) -> Option A

4. Quick Check:

   Custom token creation = admin.auth().createCustomToken [OK]

Hint: Use admin.auth().createCustomToken to generate tokens [OK]

Common Mistakes:

• Using database or storage methods incorrectly
• Confusing signInWithCustomToken with token creation
• Calling methods on firebase instead of admin SDK

3. What will the following code output if uid is 'user123' and no errors occur?

const admin = require('firebase-admin');
admin.initializeApp();

admin.auth().createCustomToken('user123')
  .then(token => console.log(typeof token))
  .catch(error => console.error(error));

medium

A. 'object'

B. An error message

C. 'undefined'

D. 'string'

Solution

1. Step 1: Understand createCustomToken return type

   The method returns a Promise that resolves to a string token.

2. Step 2: Check console.log output

   Logging typeof token will print 'string' because the token is a string.

3. Final Answer:

   'string' -> Option D

4. Quick Check:

   createCustomToken returns string token [OK]

Hint: createCustomToken returns a string token inside a Promise [OK]

Common Mistakes:

• Expecting an object instead of string
• Confusing token with undefined
• Assuming an error without cause

4. Identify the error in this code snippet for generating a custom token:

const admin = require('firebase-admin');

admin.auth().createCustomToken('12345')
  .then(token => console.log(token))
  .catch(error => console.error(error));

medium

A. Missing admin.initializeApp() call

B. Incorrect method name, should be generateCustomToken

C. createCustomToken does not return a Promise

D. UID must be a string, not a number

Solution

1. Step 1: Check initialization of Firebase Admin SDK

   The admin SDK must be initialized with admin.initializeApp() before use.

2. Step 2: Verify other parts

   The UID '12345' is a valid string, createCustomToken returns a Promise, and method name is correct.

3. Final Answer:

   Missing admin.initializeApp() call -> Option A

4. Quick Check:

   Initialize admin SDK before calling methods [OK]

Hint: Always call admin.initializeApp() before using admin SDK [OK]

Common Mistakes:

• Passing number instead of string UID
• Assuming createCustomToken is synchronous
• Using wrong method name

5. You want to add extra user info like role: 'admin' in a custom token. Which code snippet correctly adds this claim?

hard

A. admin.auth().setCustomUserClaims(uid, { role: 'admin' })

B. admin.auth().createCustomToken(uid).setClaims({ role: 'admin' })

C. admin.auth().createCustomToken(uid, { role: 'admin' })

D. admin.auth().createCustomToken(uid, { claims: { role: 'admin' } })

Solution

1. Step 1: Understand how to add extra claims in custom tokens

   The createCustomToken method accepts a second argument with additional claims as a plain object.

2. Step 2: Evaluate each option

   admin.auth().createCustomToken(uid, { role: 'admin' }) correctly passes extra claims as second argument. admin.auth().createCustomToken(uid).setClaims({ role: 'admin' }) is invalid chaining. admin.auth().setCustomUserClaims(uid, { role: 'admin' }) sets claims on user but not in token creation. admin.auth().createCustomToken(uid, { claims: { role: 'admin' } }) nests claims incorrectly.

3. Final Answer:

   admin.auth().createCustomToken(uid, { role: 'admin' }) -> Option C

4. Quick Check:

   Extra claims go as second argument in createCustomToken [OK]

Hint: Pass extra claims as second argument to createCustomToken [OK]

Common Mistakes:

• Trying to chain setClaims on token creation
• Using setCustomUserClaims instead of token claims
• Nesting claims inside another object