Firebase · Authentication Profile

Firebase Authentication

Authentication

Firebase secures its APIs with apiKey, oauth2, bearer, serviceAccount, and idToken across 5 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode and serviceAccount flow(s).

CompanyBackend as a ServiceApplication DevelopmentMobileWebAuthenticationDatabaseCloud FunctionsMessagingGoogle
Methods: apiKey, oauth2, bearer, serviceAccount, idToken Schemes: 5 OAuth flows: authorizationCode, serviceAccount API key in: query

Security Schemes

apiKey apiKey
· in: query (key)
oauth2 oauth2
serviceAccount oauth2
firebaseIdToken bearer
appCheck apiKey
· in: header (X-Firebase-AppCheck)

Source

Authentication Profile

firebase-authentication.yml Raw ↑ 
generated: '2026-07-19'
method: searched
source: >-
  https://firebase.google.com/docs/auth,
  https://firebase.google.com/docs/projects/api/reference/rest,
  https://cloud.google.com/docs/authentication
summary:
  types: [apiKey, oauth2, bearer, serviceAccount, idToken]
  api_key_in: [query]
  oauth2_flows: [authorizationCode, serviceAccount]
schemes:
- name: apiKey
  type: apiKey
  in: query
  parameter: key
  note: >-
    Firebase Web API key identifies the project on public REST endpoints
    (Identity Toolkit, RTDB, Remote Config). Not a secret by itself — access is
    governed by Security Rules and App Check.
- name: oauth2
  type: oauth2
  note: >-
    Google-hosted management/data REST APIs (Firebase Management, Firestore,
    FCM v1) authenticate with Google OAuth 2.0 bearer access tokens. See
    scopes/firebase-scopes.yml.
  authorizationUrl: https://accounts.google.com/o/oauth2/v2/auth
  tokenUrl: https://oauth2.googleapis.com/token
- name: serviceAccount
  type: oauth2
  flow: serviceAccount
  note: >-
    Admin SDK and server-to-server access use a Google service-account key
    (GOOGLE_APPLICATION_CREDENTIALS) exchanged for an OAuth access token.
- name: firebaseIdToken
  type: bearer
  bearerFormat: JWT
  note: >-
    Firebase Authentication issues client ID tokens (JWTs) verified server-side
    by the Admin SDK; issuer https://securetoken.google.com/<project-id>.
- name: appCheck
  type: apiKey
  in: header
  parameter: X-Firebase-AppCheck
  note: >-
    App Check attestation token asserting the request comes from an authentic
    app instance; complements user auth, does not replace it.