title: How can I configure Firebase Security Rules to only allow writes from a CURL/PHP source?
body: <p>I want to create a security rule in Firebase to only allow a PHP script (via a CURL request) to write to a location. </p>
  
  <p>I can read/write to Firebase using a PHP script when the security rules allow anyone with authentication to read/write by appending .json?auth=MYAPPTOKEN to the URL. </p>
  
  <p>I am also able to include/exclude users using Simple Login from reading/writing to locations, so I think I have a basic handle on the security rules syntax/operation.</p>
  
  <p>Now, I want to have a location in Firebase that is only writeable from my PHP file. </p>
  
  <p>Security rules that I've tried: </p>
  
  <pre><code>".write":"auth.secret == "MYTOKEN",
  ".write":"auth == "MYTOKEN",
  ".write":"auth.token == "MYTOKEN",
  </code></pre>
  
  <p>On the other side, I've tried modifying the .json?auth= in the request. Here's what I've tried:</p>
  
  <pre><code>$auth = array("token" =&gt; "MYTOKEN");
  $auth = json_encode($auth);
  </code></pre>
  
  <p>Second Attempt:</p>
  
  <pre><code>$auth = json_encode("MYTOKEN");
  </code></pre>
  
  <p>And then replacing the .json?auth=MYTOKEN with .json?auth=$auth </p>
  
  <p>So, how do I allow only that script to write to a location? </p>
  
  <p>Thanks guys.</p>