title: Web App Authentication/Security Best Practice with Google Cloud Database (Bigtable)
body: <p>I am developing a webapp to access data in Bigtable in Vue and hosting it on Firebase Hosting and I am using Firebase Authentication to control user access for the app. I am curious as to best practices for authentication and security when it comes to such a use case.</p>
  <p>I've read this:
  <a href="https://cloud.google.com/docs/authentication/end-user" rel="nofollow noreferrer">https://cloud.google.com/docs/authentication/end-user</a>
  <a href="https://cloud.google.com/bigtable/docs/authentication" rel="nofollow noreferrer">https://cloud.google.com/bigtable/docs/authentication</a></p>
  <p>Here is my question:
  I was taught once that the reason we build APIs in front of SQL servers for example was because we didn't want to expose the SQL server directly to the end user and risk bad things happening. So the API sits in between to act as a layer of protection.
  In the Bigtable world, Google has provided their client SDKs for Bigtable that interacts with Google APIs but it has also suggested to use service account json files in most use cases. Wouldn't this be dangerous since the service account credentials then allows anybody who somehow finds it in the app files to do read or write to Bigtable and potentially mess up the database?
  Should I build an API in front of Bigtable and use Firebase Auth to check if the client is authenticated using JWT before allowing operations? Or is there some other best practice?</p>
  <p>Also,
  <a href="https://cloud.google.com/docs/authentication/end-user" rel="nofollow noreferrer">https://cloud.google.com/docs/authentication/end-user</a>
  This article suggests that I use OAuth, so can it be linked to Firebase Authentication somehow?</p>
  <p>Thank you!</p>