The Firebase CLI can use one of four authentication methods listed in descending priority:
- User Token - DEPRECATED: this authentication method will be removed in a future major version of
firebase-tools; use a service account to authenticate instead - provide an explicit long-lived Firebase user token generated from
firebase login:ci. Note that these tokens are extremely sensitive long-lived credentials and are not the right option for most cases. Consider using service account authorization instead. The token can be set in one of two ways:
- Set the
--token flag on any command, for example
firebase --token="<token>" projects:list.
- Set the
FIREBASE_TOKEN environment variable.
- Local Login - run
firebase login to log in to the CLI directly as yourself. The CLI will cache an authorized user credential on your machine.
- Service Account - set the
GOOGLE_APPLICATION_CREDENTIALS environment variable to point to the path of a JSON service account key file. For more details, see Google Cloud's Getting started with authentication guide.
- Application Default Credentials - if you use the
gcloud CLI and log in with
gcloud auth application-default login, the Firebase CLI will use them if none of the above credentials are present.
firebase login sets a single global account for use on all projects.
If you have multiple Google accounts which you use for Firebase projects you can
authorize multiple accounts and use them on a per-project or per-command basis.
To authorize an additonal account for use with the CLI, run
You can view the list of authorized accounts with
To set the default account for a specific Firebase project directory, run
firebase login:use from within the directory and select the desired account.
To check the default account for a directory, run
firebase login:list and the
default account for the current context will be listed first.
To set the account for a specific command invocation, use the
with any command. For example
firebase --firstname.lastname@example.org deploy. The
specified account must have already been added to the Firebase CLI using
Cloud Functions Emulator
The Cloud Functions emulator is exposed through commands like
functions:shell. Emulated Cloud Functions run as independent
on your development machine which means they have their own credential discovery mechanism.
By default these
node processes are not able to discover credentials from
In order to provide a better development experience, when you are logged in to the CLI
firebase login we take the user credentials and construct a temporary credential
that we pass into the emulator through
GOOGLE_APPLICATION_CREDENTIALS. We only do this
if you have not already set the
GOOGLE_APPLICATION_CREDENTIALS environment variable