Firebase Admin SDK — Server-Side Authentication, User Management, and Token Verification

// Initialize Admin SDK (Node.js)
const admin = require('firebase-admin');

// Using service account file
const serviceAccount = require('./serviceAccountKey.json');

admin.initializeApp({
  credential: admin.credential.cert(serviceAccount),
  databaseURL: 'https://project-id.firebaseio.com'
});

// Using environment variables
admin.initializeApp({
  credential: admin.credential.applicationDefault()
});

// Server-side authentication middleware
async function authenticateRequest(req, res, next) {
  const authHeader = req.headers.authorization;

  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'No token provided' });
  }

  const idToken = authHeader.split('Bearer ')[1];

  try {
    const decodedToken = await admin.auth().verifyIdToken(idToken);
    req.user = {
      uid: decodedToken.uid,
      email: decodedToken.email,
      role: decodedToken.role,
      // Custom claims are available here
    };
    next();
  } catch (error) {
    console.error('Token verification failed:', error);
    return res.status(401).json({ error: 'Invalid token' });
  }
}

// Protected route
app.get('/api/secure-data', authenticateRequest, async (req, res) => {
  // req.user is available
  const data = await getDataForUser(req.user.uid);
  res.json(data);
});

# Python Admin SDK initialization and usage
import firebase_admin
from firebase_admin import credentials, auth, firestore

# Initialize
cred = credentials.Certificate('serviceAccountKey.json')
firebase_admin.initialize_app(cred)

# Verify ID token
def verify_token(id_token):
    try:
        decoded = auth.verify_id_token(id_token)
        return decoded['uid'], decoded.get('email')
    except auth.ExpiredIdTokenError:
        return None, 'Token expired'
    except auth.InvalidIdTokenError:
        return None, 'Invalid token'

# Flask middleware
@app.before_request
def authenticate():
    if request.path.startswith('/api/secure'):
        auth_header = request.headers.get('Authorization')
        if not auth_header or not auth_header.startswith('Bearer '):
            return {'error': 'Unauthorized'}, 401
        uid, error = verify_token(auth_header.split()[1])
        if error:
            return {'error': error}, 401
        request.user_id = uid

// Admin SDK: User management operations
const admin = require('firebase-admin');

// Create user
const userRecord = await admin.auth().createUser({
  email: 'alice@example.com',
  emailVerified: true,
  password: 'securePassword123',
  displayName: 'Alice Johnson',
  disabled: false
});
console.log('Created user:', userRecord.uid);

// Get user by email
const user = await admin.auth().getUserByEmail('alice@example.com');

// List all users
const listUsersResult = await admin.auth().listUsers(1000);
listUsersResult.users.forEach(user => {
  console.log(user.email, user.uid);
});

// Delete user
await admin.auth().deleteUser(user.uid);

// Disable user
await admin.auth().updateUser(user.uid, { disabled: true });

// Generate email verification link
const link = await admin.auth().generateEmailVerificationLink('alice@example.com');

// Generate password reset link
const resetLink = await admin.auth().generatePasswordResetLink('alice@example.com');