Authentication
Email/password auth is enabled by default per project. Toggle email verification requirement and Google sign-in in Console → Auth → Settings.
SDK methods
| Method | Returns | Notes |
|---|---|---|
auth.signUp(email, password, profile?) | user | profile: { displayName, photoURL, phone, meta } |
auth.signIn(email, password) | user | 8 wrong attempts → 15 min lock |
auth.signInWithGoogle(idToken) | user | idToken from Google Identity Services; project needs Google Client ID |
auth.signOut(allDevices?) | — | revokes refresh token(s) |
auth.currentUser / auth.token | object / JWT | synchronous, from local storage |
auth.onAuthStateChanged(fn) | unsubscribe fn | fires immediately with current state |
auth.getUser() | user | fresh from server |
auth.updateProfile({displayName, photoURL, phone, meta, password, currentPassword}) | user | |
auth.changePassword(old, new) | user | |
auth.sendVerification() / auth.verifyEmail(code) | — | 6-digit email OTP |
auth.forgotPassword(email) / auth.resetPassword(email, code, newPassword) | — | |
auth.deleteAccount() | — | deletes user (their docs stay, owner id remains) |
User object
{ uid, email, displayName, photoURL, phone, emailVerified, provider, claims: {…}, meta: {…}, createdAt, lastLogin }Tokens
Access tokens are HS256 JWTs valid 1 hour with claims sub (uid), email, ev (verified), claims (custom). The SDK refreshes automatically when a request returns auth/invalid-token. Verify tokens on your own server with the admin API or any JWT library using your project's JWT secret (Console → Settings).
Custom claims / roles
Set from your server with the secret key: PATCH /admin/users/{uid} body {"claims":{"admin":true,"role":"manager"}}. Claims appear in the token after next refresh; admin: true satisfies the admin rule level.
Google Sign-In
<script src="https://accounts.google.com/gsi/client" async></script>
<div id="g_id_onload" data-client_id="YOUR_GOOGLE_CLIENT_ID" data-callback="onGoogle"></div>
<div class="g_id_signin"></div>
<script>async function onGoogle(r){ await app.auth.signInWithGoogle(r.credential); }</script>Was this page helpful? Tell us. · Download SDK