Guide Updated

Firebase Auth JWT Issuer & Claims

Verify Firebase Auth JWTs. Firebase's issuer, JWKS URL, RS256 signing, and the user_id, sign_in_provider, firebase claims explained with validation rules.

Firebase Authentication issues JWT ID tokens that you verify in your backend to authorize requests. The ID token is signed with RS256. The issuer is https://securetoken.google.com/YOUR_PROJECT (where YOUR_PROJECT is your Firebase project ID). Firebase publishes its JWKS at a shared Google endpoint.

Issuer details

Property Firebase Auth
Issuer (iss)https://securetoken.google.com/YOUR_PROJECT
JWKS URLhttps://www.googleapis.com/service_accounts/v1/jwk/[email protected]
OIDC discoveryhttps://securetoken.google.com/YOUR_PROJECT/.well-known/openid-configuration
Signing algorithmRS256 (default)

Issuer-specific claims

Claims you will encounter in Firebase Auth JWTs and what they mean for this issuer:

Claim Meaning for this issuer
isshttps://securetoken.google.com/YOUR_PROJECT: your Firebase project ID. Validate against your exact project.
subThe Firebase user's UID. Stable across the project. Use this as the primary key.
user_idSame as sub: the Firebase user UID. Present for backwards compatibility.
audYour Firebase project ID. Validate aud on every request.
emailThe user's email. May be absent for anonymous or phone-auth users.
email_verifiedBoolean: whether the user's email is verified. Reject unverified emails for sensitive flows.
sign_in_providerThe provider used to sign in (google.com, password, phone, anonymous, etc.). Useful for conditional flows and audit logging.
firebaseAn object containing identities and sign_in_provider. Nested under the firebase claim.

Verifying tokens from this issuer

Fetch public keys from https://www.googleapis.com/service_accounts/v1/jwk/[email protected]. Hardcode algorithms: ['RS256']. Validate iss against https://securetoken.google.com/YOUR_PROJECT and aud against your Firebase project ID. The official Firebase Admin SDKs (Node.js, Python, Java, Go) handle all of this for you via admin.auth().verifyIdToken(token): prefer the SDK over manual verification unless you cannot use it.

Frequently asked questions

  • How do I verify a Firebase ID token?

    The recommended way is the Firebase Admin SDK: admin.auth().verifyIdToken(token) in Node.js, firebase_admin.auth.verify_id_token(token) in Python. The SDK fetches the JWKS, verifies the RS256 signature, and validates iss, aud, and exp for you. For manual verification, fetch public keys from https://www.googleapis.com/service_accounts/v1/jwk/[email protected], hardcode algorithms: ['RS256'], and validate iss (https://securetoken.google.com/YOUR_PROJECT) and aud (your project ID).

  • What is the Firebase JWT issuer URL?

    The iss claim is https://securetoken.google.com/YOUR_PROJECT, where YOUR_PROJECT is your Firebase project ID. Validate iss against your exact project. The JWKS endpoint is shared across Firebase projects at https://www.googleapis.com/service_accounts/v1/jwk/[email protected], and Firebase signs with RS256.

  • Should I use the Firebase Admin SDK or verify JWTs manually?

    Use the Firebase Admin SDK (admin.auth().verifyIdToken) whenever you can: it handles JWKS fetching, caching, signature verification, and iss/aud/exp validation correctly and stays current with Firebase's key rotation. Verify manually only when you cannot use the SDK (e.g. a non-SDK language or a constraint that prevents the SDK). The manual process is straightforward but easy to get wrong on claim validation.

Related