title: Use JSON Web Token and Firestore support for Bearer token
body: <p>I want to have authentication and authorization support in Firestore while using a node.js app that talks to Firestore. Users interact via a URL (http.get with embedded tokens) and that interacts with a node.js app. The app accepts some input from user, then talks to firestore.  The access token needed for the client to perform secure activities are all embedded in the GET url (the id + access token).  </p>
  
  <p>I have a flow here, and want to validate if this flow is right or I am missing something?   I am unable to find the most definite document that can guide me on the steps to follow.</p>
  
  <p>First off I  generate JWT token part before generating the GET url:
  The function used to generate the JWT token is as follows:
  // generate JWT token</p>
  
  <pre><code>function getJWT() {
    var token = jwt.sign({
      exp: Math.floor(Date.now() / 1000) + (60 * 60) * constants.JWT_TOKEN_VALIDITY_HOURS,
      admin: '​XXXXXXX'
    }, constants.JWT_SECRET_TOKEN);
    return token;
  }
  </code></pre>
  
  <p>Bearer Tokens: ​I have heard in many forums that it is possible for me to send this JWT web token as a "Bearer token" in the authorisation header. It means firestore magically does all the authorization for me. Anything else I should be doing?</p>
  
  <p>1) I believe I need to sign in using this custom JSON web token, and obtain an ID token.  is that correct? 
  Sign in from a Firebase Client SDK
  Use the Firebase Auth REST API to exchange the custom token to an ID token.
  2) Then I need pass this ID token (not the JSON web token) to the Cloud Firestore endpoints when I am making a request for db access as an Authorization header set to Bearer {YOUR_TOKEN}.. Then you can access the Firestore REST API with the resulting ID token:
  <a href="https://firebase.google.com/docs/firestore/use-rest-api#working_with_firebase_id_tokens" rel="nofollow noreferrer">https://firebase.google.com/docs/firestore/use-rest-api#working_with_firebase_id_tokens</a></p>
  
  <p>Imagine I embed into the header the bearer token also...using the JSON access token or the ID token I get from firestore</p>
  
  <pre><code>return this.http
  .get(${OUR URL to app}, {
  headers: new HttpHeaders().set('Authorization', Bearer ${JSON Web accessToken or ID Token})
  })​
  </code></pre>
  
  <p>​User clicks on the URL that has this access token. They agree to terms and conditions and then I re-direct them to a cloud function that does some processing.​ This JSON Web token is passed along.  I verify the JWT token also​ for authentication purpose using this code.​</p>
  
  <pre><code>function verifyToken(token) {
    try {
      var decoded = jwt.verify(token, constants.JWT_SECRET_TOKEN);
      var admin = decoded.admin;
      if (admin == "​XXXXXXXXX") {
        return true;
      }
      return false;
    } catch (err) {
      console.log(err);
      return false;
    }
  }
  </code></pre>
  
  <p>​any samples related to this will be helpful.​</p>
  
  <p>related links I used
  <a href="https://firebase.google.com/docs/firestore/use-rest-api#working_with_firebase_id_tokens" rel="nofollow noreferrer">https://firebase.google.com/docs/firestore/use-rest-api#working_with_firebase_id_tokens</a></p>
  
  <p><a href="https://stackoverflow.com/questions/50687648/firestore-custom-tokens">Firestore Custom Tokens</a></p>
  
  <p><a href="https://auth0.com/blog/how-to-authenticate-firebase-and-angular-with-auth0-part-1/" rel="nofollow noreferrer">https://auth0.com/blog/how-to-authenticate-firebase-and-angular-with-auth0-part-1/</a></p>
  
  <p>finally 
  Protocol specification for https.onCall
  in <a href="https://firebase.google.com/docs/functions/callable-reference" rel="nofollow noreferrer">https://firebase.google.com/docs/functions/callable-reference</a></p>
  
  <p>Optional: Authorization: Bearer 
  A Firebase Authentication user ID token for the logged-in user making the request. The backend automatically verifies this token and makes it available in the handler's context. If the token is not valid, the request is rejected.</p>