title: Using Custom Tokens to make REST requests to FB DB as an admin
body: <p>I'm migrating to the new database and 3.0 client libs. I'm updating the part which generates a custom auth token (on our server) to do a <code>PATCH</code> to update a resource in the Firebase DB.</p>
  
  <p>These PATCH requests used to be made by our server to Firebase using <code>admin</code> claims based on this: <a href="https://www.firebase.com/docs/rest/guide/user-auth.htm" rel="nofollow noreferrer">https://www.firebase.com/docs/rest/guide/user-auth.htm</a></p>
  
  <p>For the new DB, I'm generating the JWT token (using <code>ruby-jwt</code>) like this:</p>
  
  <pre><code>payload = {
    aud: "https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit",
    claims: custom_claims.merge({ admin: true }),
    exp: now_seconds + (60 * 60), # Maximum expiration time is one hour
    iat: now_seconds,
    iss: service_account_email,
    sub: service_account_email,
    uid: uid
  }
  
  JWT.encode(payload, private_key, "RS256")
  </code></pre>
  
  <p>A <code>PATCH</code> request with this token to the Firebase DB fails with: <code>Missing claim 'kid' in auth header</code>.</p>