# Add Firebase Authentication Safely

Firebase sign-in setup can become inconsistent across providers and security rules. This skill gives focused guidance for Firebase Auth basics in AI coding sessions.

## Install

```bash
npx skillstore add firebase/firebase-auth-basics
```

## Metadata

- Status: approved
- Slug: firebase-firebase-auth-basics
- Skillstore revision: r1
- Version status: missing
- Tree hash: 2b42b79b2f7146049288c01c17373700414f728cd01f180e8fa8c402758a37f5
- Author: firebase
- GitHub username: firebase
- License: MIT
- Repository: https://github.com/firebase/agent-skills/tree/main/skills/firebase-auth-basics/
- Ref: 30c73eac2afe762f6aa9c4553158769369d47351
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, external\_commands
- Quality score: 74
- Public page: https://skillstore.pages.dev/skills/firebase-firebase-auth-basics
- Manifest: https://skillstore.pages.dev/api/skills/firebase-firebase-auth-basics/manifest

## Capabilities

- Explains Firebase Auth users, identity providers, ID tokens, and refresh tokens.
- Shows setup paths through the Firebase CLI or Firebase Console.
- Provides Web SDK guidance for email, OAuth, anonymous, and email-link sign-in.
- Covers auth state observation and sign-out behavior for web apps.
- Describes security rule checks using request.auth and owner matching.

## Use Cases

- Add web sign-in: Plan email, OAuth, anonymous, or email-link sign-in for a Firebase web app.
- Protect user data: Connect Firebase Authentication concepts to security rules that check signed-in users and ownership.
- Review auth flow: Check whether a planned Firebase Auth flow covers provider setup, user state, and rule enforcement.

## Prompt Templates

### Start email sign-in

```
Use this skill to add Firebase email and password sign-up and sign-in to my web app. Show the setup steps and explain required Firebase configuration.
```

### Add OAuth provider

```
Use this skill to configure Google sign-in for my Firebase web app. Include provider enablement, SDK setup, auth state handling, and sign-out behavior.
```

### Protect user-owned data

```
Use this skill to design Firebase rules so users can read and write only their own profile documents. Include request.auth checks and ownership matching.
```

### Review auth design

```
Use this skill to review my Firebase Auth plan for web, email links, OAuth, anonymous accounts, and rules. Identify gaps and safer defaults.
```

## Limitations

- Focuses on web SDK snippets and basic rules, not complete application architecture.
- Does not provision Firebase resources automatically.
- Some provider setup still requires Firebase Console configuration.
- Does not replace threat modeling, production rule testing, or compliance review.

## Best Practices

- Enable only required providers and keep authorized redirect domains limited.
- Use the Auth emulator during local development before production testing.
- Write rules that verify request.auth and resource ownership for every protected path.

## Anti Patterns

- Treating client-side auth state as the only access control.
- Leaving broad read or write rules after adding sign-in.
- Using placeholder redirect domains or sample URLs in production configuration.

## Security Audit

- Audited at: 2026-07-05T16:08:06.351\+00:00
- Summary: The static findings are false positives caused by Markdown inline code, sample Firebase configuration, localhost emulator URLs, and official Firebase documentation links. I found no evidence of prompt injection, credential exfiltration, hidden execution, or malicious network behavior in the reviewed files.

## Stats

- Views: 95
- Downloads: 7
- Favorites: 0
- Popularity score: 0