title: Using Google Firebase Golang libraries (e.g. IAP and Firestore) for a non-admin client application
body: <h1>Brief description</h1>
  
  <p>Hi everyone,</p>
  
  <p>I am working with Golang, developing a software to run locally at home but also synchronize with some cloud data (individually secured per user login). For that, I decided to use Google Cloud Service - Firebase (IAP, Hosting, Functions, and Firestore). Let me tell you, I am loving to develop and learn about these.</p>
  
  <p>However, here comes the problem: I get really confused with the Golang tools (libraries) provided by Google to work on their service. They seem to have well-defined Golang libraries to work with their services <strong>IF</strong> your code is running in a trusted machine since you have to export credentials to it.</p>
  
  <p>In my case, the software I am developing will run on the client machine and so I need a client login to IAP, etc.
   Can anyone help me with that?</p>
  
  <h1>Issue</h1>
  
  <ol>
  <li>none of the tool available seem to be specific for Golang client (not-admin)</li>
  <li>Google provides many, MANY repositories, and links to different tools that seem to do similar things, which one of them is for Admin usage, which one uses their RPC server, which one could I use for my client?
  
  <ul>
  <li>cloud.google.com/go/</li>
  <li>firebase.google.com/go</li>
  <li><a href="https://github.com/googleapis/google-cloud-go" rel="noreferrer">https://github.com/googleapis/google-cloud-go</a></li>
  <li>google.golang.org/api/ (Deprecated, but still referenced in their <a href="https://cloud.google.com/apis/docs/client-libraries-explained" rel="noreferrer">documentation</a>)</li>
  </ul></li>
  <li>Google has very similar names for different versions of the same things;</li>
  <li>Documentation does not seem to be clear enough to me, and if they have a specific library or not for my case.</li>
  </ol>
  
  <h1>What I achieved</h1>
  
  <ul>
  <li>Using the REST API I managed to get the tokenID (login) with one user account (created inside my IAP project);</li>
  <li>With its tokenID, I managed to use the REST API to retrieve some document that he has access;</li>
  <li>With the following code, I manage to use one of the Golang libraries (supposedly for admin credentials) to retrieve the same documents using a private IAP user account of my project.</li>
  </ul>
  
  <pre><code>    package main
  
      import (
          "context"
          "fmt"
  
          "cloud.google.com/go/firestore"
          "golang.org/x/oauth2"
          "google.golang.org/api/option"
      )
  
      func main() {
          ctx := context.Background()
          token := oauth2.Token{
              AccessToken:  "TOKEN_ID-FROM-IAP",
              TokenType:    "Bearer",
              RefreshToken: "REFRESH_TOKEN-from-IAP",
          }
  
          oauthClient := &amp;oauth2.Config{}
          tSource := oauthClient.TokenSource(ctx, &amp;token)
  
          client, err := firestore.NewClient(ctx, "ProjectID", option.WithTokenSource(tSource))
          if err != nil {
              // TODO: Handle error.
          }
          defer client.Close()
  
          iter := client.Doc("docPath").Snapshots(ctx)
  
          defer iter.Stop()
          for {
              docsnap, err := iter.Next()
              if err != nil {
                  // TODO: Handle error.
              }
  
              dataMap := docsnap.Data()
              fmt.Println(dataMap)
          }
      }
  </code></pre>
  
  <h1>Final questions</h1>
  
  <p>From the perspective of a non-admin client account of a private Firebase project:</p>
  
  <ul>
  <li>Can anyone explain/clarify these many libraries?</li>
  <li>I used oauth2 with the IAP token (acquired with the REST API), will this package work fine from now on?</li>
  <li>Can I use oauth2 package to do more with IAP service? Like, renew the token, make login?</li>
  </ul>
  
  <p>I appreciate thoughts and suggestions,
  Thank you in advance!</p>