title: Access Firebase Cloud Storage server-side with security rules applied
body: <p>On my Firebase app, I'd like to know the recommended way to make a server-side request to Cloud Storage for Firebase on behalf of a signed-in user (authenticated via ID token), with security rules applied to the request (i.e. not with the Admin SDK).</p>
  <p>The overall app flow currently looks like this:</p>
  <ul>
  <li>User signs in on the client and makes a request to a Google Cloud API gateway, sending their <a href="https://firebase.google.com/docs/auth/admin/verify-id-tokens#retrieve_id_tokens_on_clients" rel="nofollow noreferrer">ID token</a> in the request header</li>
  <li>API gateway <a href="https://cloud.google.com/api-gateway/docs/authenticating-users-firebase" rel="nofollow noreferrer">authenticates user</a> and forwards request to different endpoints in the backend API:
  <ul>
  <li>If it's a request for <strong>Firebase Authentication</strong>, the API uses <a href="https://firebase.google.com/docs/auth/admin/manage-users" rel="nofollow noreferrer">Auth Admin SDK</a> to handle it directly</li>
  <li>If it's for <strong>Firestore</strong>, the API uses the <code>x-forwarded-authorization</code> request header (which contains the ID token originally provided by the client) forwarded by API gateway to then make a request to <a href="https://firebase.google.com/docs/firestore/use-rest-api#authenticating_with_an_access_token" rel="nofollow noreferrer">Firestore's REST API</a>, so that the request can be evaluated by security rules.</li>
  </ul>
  </li>
  </ul>
  <p>For <strong>Cloud Storage</strong>, I'd like to do something similar to the Firestore case above, but there isn't a Firebase-specific REST API available in the docs. It's possible to just let the client make requests directly to Firebase (as suggested in this <a href="https://stackoverflow.com/questions/14673929/using-nodejs-with-firebase-security">answer</a>), but would prefer to keep the logic in the backend.</p>
  <p>Are there alternatives to doing this for Storage? Please feel free to also point out if there are better ways of handling the Firebase Auth and Firestore cases mentioned above. Thanks!</p>
  <p><strong>EDIT:</strong> Adding more possible solutions as I find them</p>
  <ul>
  <li>Doug's answer <a href="https://stackoverflow.com/questions/63615651/authenticate-firebase-storage-with-firebase-id-token">here</a> and Frank's answer <a href="https://stackoverflow.com/questions/54068067/access-google-cloud-storage-with-firebase-credential">here</a> suggest using the Cloud Storage REST API, where the app generates an OAuth token for the user and <a href="https://cloud.google.com/storage/docs/authentication#user_accounts" rel="nofollow noreferrer">makes the request</a></li>
  <li>This answer <a href="https://stackoverflow.com/questions/42927643/firebase-rest-auth-when-creating-token-with-node-js-admin-sdk">here</a> mentions it's possible to pass an <code>auth=IDTOKEN</code> query parameter to the Firebase REST API:</li>
  </ul>
  <blockquote>
  <p>Once you have an ID token, you can pass that to the REST API via the
  auth query parameter to authenticate a request. The request respects
  Firebase Security Rules as if the end user logged into the client was
  making the request.</p>
  </blockquote>