CODEWITHSUNDEEP
firebasefirebase-authentication
melchoir55
melchoir55

Reputation: 7286

Create firebase auth token which never expires

We are generating custom firebase auth tokens. Unfortunately, the maximum lifetime of such a token is one hour: https://firebase.google.com/docs/auth/admin/create-custom-tokens?hl=en#letting_the_admin_sdk_discover_a_service_account

We are generating these tokens to act as the Bearer auth for a web service api. In this context, it is not appropriate to expire a token. Doing so runs a very high risk of clients losing revenue. Even if you were to expire them, one hour is comically short for an expiration. Consequently, we need jwt tokens which do not expire. Does anyone know how to do this with the firebase auth system?

Upvotes: 1

Views: 2290

Answers (1)

Obum
Obum

Reputation: 1633

Based on the comments:

As @Dharmaraj said, The custom auth token from the admin SDK is for signing in the user immediately and expires in an hour. You can't increase the expiry time. Firebase takes care of refreshing the sign-in state with tokens from their servers.

But given that you need this for web service API and you don't need the user to sign in you have two options:

  1. Look for a way to have the client sign in with the custom token and then use firebase callable functions to make requests (you can identify the signed-in user from context.auth). Also, you won't need to set the Authorization header

  2. Use your own JWT tokens without firebase. Firebase custom tokens are for the client and not for the admin SDK.

Firebase is a backend service and can't do everything. It favors serverless architecture and not the creation of well-customized APIs as you want.

Upvotes: 3

Related Questions