Firebase REST

AUTHENTICATION

Reference: https://firebase.google.com/docs/reference/rest/auth/

You can query the Firebase Auth backend through a REST API. This can be used for various operations such as creating new users, signing in existing ones and editing or deleting these users.

Throughout this document, API_KEY refers to the Web API Key, which can be obtained on the project settings page in your admin console.

NOTE!

All URL's presented below have the following FB_URL prepended:

FB_URL = 'https://www.googleapis.com/identitytoolkit/v3/relyingparty'

You can create a new email and password user by issuing an HTTP POST request to the Auth signupNewUser endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/signupNewUser?key=[API_KEY]`

Request Body Payload

Property Name	Type	Description
`email`	string	The email for the user to create.
`password`	string	The password for the user to create.
`returnSecureToken`	boolean	Whether or not to return an ID and refresh token. Should always be true.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#SignupNewUserResponse"`.
`idToken`	string	A Firebase Auth ID token for the newly created user.
`email`	string	The email for the newly created user.
`refreshToken`	string	A Firebase Auth refresh token for the newly created user.
`expiresIn`	string	The number of seconds in which the ID token expires.
`localId`	string	The uid of the newly created user.

A successful request is indicated by a 200 OK HTTP status code. The response contains the Firebase ID token and refresh token associated with the new account.

Sample Response

{
  "kind": "identitytoolkit#SignupNewUserResponse",
  "idToken": "[ID_TOKEN]",
  "email": "[user@example.com]",
  "refreshToken": "[REFRESH_TOKEN]",
  "expiresIn": "3600",
  "localId": "tRcfmLH7..."
}

1
2
3
4
5
6
7
8

Common Error Codes

Returned Message	Description
`EMAIL_EXISTS`	The email address is already in use by another account.
`OPERATION_NOT_ALLOWED`	Password sign-in is disabled for this project.
`TOO_MANY_ATTEMPTS_TRY_LATER`	We have blocked all requests from this device due to unusual activity. Try again later.

You can sign in a user with an email and password by issuing an HTTP POST request to the Auth verifyPassword endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/verifyPassword?key=[API_KEY]`

Request Body Payload

Property Name	Type	Description
`email`	string	The email the user is signing in with.
`password`	string	The password for the account.
`returnSecureToken`	boolean	Whether or not to return an ID and refresh token. Should always be true.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#VerifyPasswordResponse"`.
`idToken`	string	A Firebase Auth ID token for the authenticated user.
`email`	string	The email for the authenticated user.
`refreshToken`	string	A Firebase Auth refresh token for the authenticated user.
`expiresIn`	string	The number of seconds in which the ID token expires.
`localId`	string	The uid of the authenticated user.
`registered`	boolean	Whether the email is for an existing account.

A successful request is indicated by a 200 OK HTTP status code. The response contains the Firebase ID token and refresh token associated with the existing email/password account.

Sample response

{
  "kind": "identitytoolkit#VerifyPasswordResponse",
  "localId": "ZY1rJK0eYLg...",
  "email": "[user@example.com]",
  "displayName": "",
  "idToken": "[ID_TOKEN]",
  "registered": true,
  "refreshToken": "[REFRESH_TOKEN]",
  "expiresIn": "3600"
}

1
2
3
4
5
6
7
8
9
10

Common Error Codes

Returned Message	Description
`EMAIL_NOT_FOUND`	There is no user record corresponding to this identifier. The user may have been deleted.
`INVALID_PASSWORD`	The password is invalid or the user does not have a password.
`USER_DISABLED`	The user account has been disabled by an administrator.

{
  "email": "kematzy@gmail.com",
  "password": "12345678",
  "returnSecureToken": true
}

HTTP/1.1 200 OK
Content-Type: application/json; charset=UTF-8

{
  "kind": "identitytoolkit#VerifyPasswordResponse",
  "localId": "0Rf6pNWZMPQkrilbkr1MoTcGFWC3",
  "email": "kematzy@gmail.com",
  "displayName": "",
  "idToken": "eyJhbGciOiJSUzI1NiI .... fQ.eyZCJ9fQ.cQRLq3-fL9hTzHKQ",
  "registered": true,
  "refreshToken": "AEu4IL33sxVtylMyetlc8FM ... -b1wi7QnVrG1Bd qb5RA",
  "expiresIn": "3600"
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

{
  "email": "invalid2email.com",
  "password": "password",
  "returnSecureToken": true
}

HTTP/1.1 400 Bad Request
{
  "error": {
    "code": 400,
    "message": "INVALID_EMAIL",
    "errors": [
      {
        "message": "INVALID_EMAIL",
        "domain": "global",
        "reason": "invalid"
      }
    ]
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

{
  "email": "kematzy@gmail.com",
  "password": "",
  "returnSecureToken": true
}

HTTP/1.1 400 Bad Request
{
  "error": {
    "code": 400,
    "message": "MISSING_PASSWORD",
    "errors": [
      {
        "message": "MISSING_PASSWORD",
        "domain": "global",
        "reason": "invalid"
      }
    ]
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

{
  "email": "kematzy@gmail.com",
  "password": "wrong",
  "returnSecureToken": true
}

HTTP/1.1 400 Bad Request
{
  "error": {
    "code": 400,
    "message": "INVALID_PASSWORD",
    "errors": [
      {
        "message": "INVALID_PASSWORD",
        "domain": "global",
        "reason": "invalid"
      }
    ]
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

{
  "email": "unreg@email.com",
  "password": "12345678",
  "returnSecureToken": true
}

HTTP/1.1 400 Bad Request
{
  "error": {
    "code": 400,
    "message": "EMAIL_NOT_FOUND",
    "errors": [
      {
        "message": "EMAIL_NOT_FOUND",
        "domain": "global",
        "reason": "invalid"
      }
    ]
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

You can sign in a user with an OAuth credential by issuing an HTTP POST request to the Auth verifyAssertion endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/verifyAssertion?key=[API_KEY]`

Request Body Payload

Property Name	Type	Description
`requestUri`	string	The URI to which the IDP redirects the user back.
`postBody`	string	Contains the OAuth credential (an ID token or access token) and provider ID which issues the credential.
`returnSecureToken`	boolean	Whether or not to return an ID and refresh token. Should always be true.
`returnIdpCredential`	boolean	Whether to force the return of the OAuth credential on the following errors: `FEDERATED_USER_ID_ALREADY_LINKED` and `EMAIL_EXISTS`.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#VerifyAssertionResponse"`.
`federatedId`	string	The unique ID identifies the IdP account.
`providerId`	string	The linked provider ID (e.g. "google.com" for the Google provider).
`localId`	string	The uid of the authenticated user.
`emailVerified`	boolean	Whether the sign-in email is verified.
`email`	string	The email of the account.
`oauthIdToken`	string	The OIDC id token if available.
`oauthAccessToken`	string	The OAuth access token if available.
`oauthTokenSecret`	string	The OAuth 1.0 token secret if available.
`rawUserInfo`	string	The stringified JSON response containing all the IdP data corresponding to the provided OAuth credential.
`firstName`	string	The first name for the account.
`lastName`	string	The last name for the account.
`fullName`	string	The full name for the account.
`displayName`	string	The display name for the account.
`photoUrl`	string	The photo Url for the account.
`idToken`	string	A Firebase Auth ID token for the authenticated user.
`refreshToken`	string	A Firebase Auth refresh token for the authenticated user.
`expiresIn`	string	The number of seconds in which the ID token expires.
`needConfirmation`	boolean	Whether another account with the same credential already exists. The user will need to sign in to the original account and then link the current credential to it.

A successful request is indicated by a 200 OK HTTP status code. The response contains the Firebase ID token and refresh token associated with the authenticated user.

Sample response with OAuth ID token

{
  "kind": "identitytoolkit#VerifyAssertionResponse",
  "federatedId": "https://accounts.google.com/1234567890",
  "providerId": "google.com",
  "localId": "5xwsPCWYo...",
  "emailVerified": true,
  "email": "user@example.com",
  "oauthIdToken": "[GOOGLE_ID_TOKEN]",
  "firstName": "John",
  "lastName": "Doe",
  "fullName": "John Doe",
  "displayName": "John Doe",
  "idToken": "[ID_TOKEN]",
  "photoUrl": "https://lh5.googleusercontent.com/.../photo.jpg",
  "refreshToken": "[REFRESH_TOKEN]",
  "expiresIn": "3600",
  "rawUserInfo": "{\"updated_time\":\"2017-02-22T01:10:57+0000\",\"gender\":\"male\", ...}"
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

A successful request is indicated by a 200 OK HTTP status code. The response contains the Firebase ID token and refresh token associated with the authenticated user.

Sample response with OAuth access token

{
  "kind": "identitytoolkit#VerifyAssertionResponse",
  "federatedId": "http://facebook.com/1234567890",
  "providerId": "facebook.com",
  "localId": "5xwsPCWYo...",
  "emailVerified": true,
  "email": "user@example.com",
  "oauthAccessToken": "[FACEBOOK_ACCESS_TOKEN]",
  "firstName": "John",
  "lastName": "Doe",
  "fullName": "John Doe",
  "displayName": "John Doe",
  "idToken": "[ID_TOKEN]",
  "photoUrl": "https://scontent.xx.fbcdn.net/v/...",
  "refreshToken": "[REFRESH_TOKEN]",
  "expiresIn": "3600",
  "rawUserInfo": "{\"updated_time\":\"2017-02-22T01:10:57+0000\",\"gender\":\"male\", ...}"
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

A successful request is indicated by a 200 OK HTTP status code. The response contains the Firebase ID token and refresh token associated with the authenticated user.

Sample response with Twitter OAuth 1.0 credential

{
  "kind": "identitytoolkit#VerifyAssertionResponse",
  "federatedId": "http://twitter.com/1234567890",
  "providerId": "twitter.com",
  "localId": "5xwsPCWYo...",
  "emailVerified": true,
  "email": "user@example.com",
  "oauthAccessToken": "[OAUTH_ACCESS_TOKEN]",
  "oauthTokenSecret": "[OAUTH_TOKEN_SECRET]",
  "firstName": "John",
  "lastName": "Doe",
  "fullName": "John Doe",
  "displayName": "John Doe",
  "idToken": "[ID_TOKEN]",
  "photoUrl": "http://abs.twimg.com/sticky/...",
  "refreshToken": "[REFRESH_TOKEN]",
  "expiresIn": "3600",
  "rawUserInfo": "{\"updated_time\":\"2017-02-22T01:10:57+0000\",\"gender\":\"male\", ...}"
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

Common Error Codes

Returned Message	Description
`OPERATION_NOT_ALLOWED`	The corresponding provider is disabled for this project.
`INVALID_IDP_RESPONSE`	The supplied auth credential is malformed or has expired.

FETCH PROVIDERS FOR EMAIL

You can look all providers associated with a specified email by issuing an HTTP POST request to the Auth createAuthUri endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/createAuthUri?key=[API_KEY]`

Request Body Payload

Property Name	Type	Description
`identifier`	string	User's email address
`continueUri`	string	The URI to which the IDP redirects the user back. For this use case, this is just the current URL.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#CreateAuthUriResponse"`.
`allProviders`	List of strings	The list of providers that the user has previously signed in with.
`registered`	boolean	Whether the email is for an existing account

A successful request is indicated by a 200 OK HTTP status code. The response contains the list of providers associated with the email.

Sample response

{
  "kind": "identitytoolkit#CreateAuthUriResponse",
  "allProviders": [
    "password",
    "google.com"
  ],
  "registered": true
}

1
2
3
4
5
6
7
8

Common Error Codes

Returned Message	Description
`INVALID_EMAIL`	The email address is badly formatted.

SEND PASSWORD RESET EMAIL

You can send a password reset email by issuing an HTTP POST request to the Auth getOobConfirmationCode endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/getOobConfirmationCode?key=[API_KEY]`

Optional Headers

Property Name	Description
`X-Firebase-Locale`	The language code corresponding to the user's locale. Passing this will localize the password reset email sent to the user.

Request Body Payload

Property Name	Type	Description
`requestType`	string	The kind of OOB code to return. Should be `"PASSWORD_RESET"` for password reset.
`email`	string	User's email address.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#GetOobConfirmationCodeResponse"`.
`email`	string	User's email address.

A successful request is indicated by a 200 OK HTTP status code.

Sample Response

{
  "kind": "identitytoolkit#GetOobConfirmationCodeResponse",
  "email": "[user@example.com]"
}

1
2
3
4

Common Error Codes

Returned Message	Description
`EMAIL_NOT_FOUND`	There is no user record corresponding to this identifier. The user may have been deleted.

VERIFY PASSWORD RESET CODE

You can verify a password reset code by issuing an HTTP POST request to the Auth resetPassword endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/resetPassword?key=[API_KEY]`

Request Body Payload

Property Name	Type	Description
`oobCode`	string	The email action code sent to the user's email for resetting the password.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#ResetPasswordResponse"`.
`email`	string	User's email address.
`requestType`	string	Type of the email action code. Should be `"PASSWORD_RESET"`.

A successful request is indicated by a 200 OK HTTP status code.

Sample response

{
  "kind": "identitytoolkit#ResetPasswordResponse",
  "email": "[user@example.com]",
  "requestType": "PASSWORD_RESET"
}

1
2
3
4
5

Common Error Codes

Returned Message	Description
`OPERATION_NOT_ALLOWED`	Password sign-in is disabled for this project.
`EXPIRED_OOB_CODE`	The action code has expired.
`INVALID_OOB_CODE`	The action code is invalid. This can happen if the code is malformed, expired, or has already been used.

CONFIRM PASSWORD RESET

You can apply a password reset change by issuing an HTTP POST request to the Auth resetPassword endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/resetPassword?key=[API_KEY]`

Request Body Payload

Property Name	Type	Description
`oobCode`	string	The email action code sent to the user's email for resetting the password.
`newPassword`	string	The user's new password.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#ResetPasswordResponse"`.
`email`	string	User's email address.
`requestType`	string	Type of the email action code. Should be `"PASSWORD_RESET"`.

A successful request is indicated by a 200 OK HTTP status code.

Sample Response

{
  "kind": "identitytoolkit#ResetPasswordResponse",
  "email": "[user@example.com]",
  "requestType": "PASSWORD_RESET"
}

1
2
3
4
5

Common Error Codes

Returned Message	Description
`OPERATION_NOT_ALLOWED`	Password sign-in is disabled for this project.
`EXPIRED_OOB_CODE`	The action code has expired.
`INVALID_OOB_CODE`	The action code is invalid. This can happen if the code is malformed, expired, or has already been used.
`USER_DISABLED`	The user account has been disabled by an administrator.

CHANGE EMAIL

You can change a user's email by issuing an HTTP POST request to the Auth setAccountInfo endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/setAccountInfo?key=[API_KEY]`

Optional Headers

Property Name	Description
`X-Firebase-Locale`	The language code corresponding to the user's locale. Passing this will localize the email change revocation sent to the user.

Request Body Payload

Property Name	Type	Description
`idToken`	string	A Firebase Auth ID token for the user.
`email`	string	The user's new email.
`returnSecureToken`	boolean	Whether or not to return an ID and refresh token.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#SetAccountInfoResponse"`.
`localId`	string	The uid of the current user.
`email`	string	User's email address.
`passwordHash`	string	Hash version of the password.
`providerUserInfo`	(List of JSON objects)	List of all linked provider objects which contain `"providerId"` and `"federatedId"`.
`idToken`	string	New Firebase Auth ID token for user.
`refreshToken`	string	A Firebase Auth refresh token.
`expiresIn`	string	The number of seconds in which the ID token expires.

A successful request is indicated by a 200 OK HTTP status code. The response contains the new Firebase ID token and refresh token associated with the user.

Sample response

{
  "kind": "identitytoolkit#SetAccountInfoResponse",
  "localId": "tRcfmLH7o2...",
  "email": "[user@example2.com]",
  "passwordHash": "...",
  "providerUserInfo": [
    {
      "providerId": "password",
      "federatedId": "[user@example2.com]"
    }
  ],
  "idToken": "[NEW_ID_TOKEN]",
  "refreshToken": "[NEW_REFRESH_TOKEN]",
  "expiresIn": "3600"
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

Common Error Codes

Returned Message	Description
`EMAIL_EXISTS`	The email address is already in use by another account.
`INVALID_ID_TOKEN`	The user's credential is no longer valid. The user must sign in again.

CHANGE PASSWORD

You can change a user's password by issuing an HTTP POST request to the Auth setAccountInfo endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/setAccountInfo?key=[API_KEY]`

Request Body Payload

Property Name	Type	Description
`idToken`	string	A Firebase Auth ID token for the user.
`password`	string	User's new password.
`returnSecureToken`	boolean	Whether or not to return an ID and refresh token.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#SetAccountInfoResponse"`.
`localId`	string	The uid of the current user.
`email`	string	User's email address.
`passwordHash`	string	Hash version of password.
`providerUserInfo`	List of JSON objects	List of all linked provider objects which contain `"providerId"` and `"federatedId"`.
`idToken`	string	New Firebase Auth ID token for user.
`refreshToken`	string	A Firebase Auth refresh token.
`expiresIn`	string	The number of seconds in which the ID token expires.

A successful request is indicated by a 200 OK HTTP status code. The response contains the new Firebase ID token and refresh token associated with the user.

Sample Response

{
  "kind": "identitytoolkit#SetAccountInfoResponse",
  "localId": "tRcfmLH7o2...",
  "email": "[user@example.com]",
  "passwordHash": "...",
  "providerUserInfo": [
    {
      "providerId": "password",
      "federatedId": "[user@example.com]"
    }
  ],
  "idToken": "[NEW_ID_TOKEN]",
  "refreshToken": "[NEW_REFRESH_TOKEN]",
  "expiresIn": "3600"
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

Common Error Codes

Returned Message	Description
`INVALID_ID_TOKEN`	The user's credential is no longer valid. The user must sign in again.
`WEAK_PASSWORD`	The password must be 6 characters long or more.

UPDATE PROFILE

You can update a user's profile (display name / photo URL) by issuing an HTTP POST request to the Auth setAccountInfo endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/setAccountInfo?key=[API_KEY]`

Request Body Payload

Property Name	Type	Description
`idToken`	string	A Firebase Auth ID token for the user.
`displayName`	string	User's new display name.
`photoUrl`	string	User's new photo url.
`deleteAttribute`	(List of strings)	List of attributes to delete, `"DISPLAY_NAME"` or `"PHOTO_URL"`. This will nullify these values.
`returnSecureToken`	boolean	Whether or not to return an ID and refresh token.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#SetAccountInfoResponse"`.
`localId`	string	The uid of the current user.
`email`	string	User's email address.
`displayName`	string	User's new display name.
`photoUrl`	string	User's new photo url.
`passwordHash`	string	Hash version of password.
`providerUserInfo`	(List of JSON objects)	List of all linked provider objects which contain `"providerId"` and `"federatedId"`.
`idToken`	string	New Firebase Auth ID token for user.
`refreshToken`	string	A Firebase Auth refresh token.
`expiresIn`	string	The number of seconds in which the ID token expires.

A successful request is indicated by a 200 OK HTTP status code.

Sample Response

{
  "kind": "identitytoolkit#SetAccountInfoResponse",
  "localId": "tRcfmLH...",
  "email": "user@example2.com",
  "displayName": "John Doe",
  "photoUrl": "[http://localhost:8080/img1234567890/photo.png]",
  "passwordHash": "...",
  "providerUserInfo": [
    {
      "providerId": "password",
      "federatedId": "user@example2.com",
      "displayName": "John Doe",
      "photoUrl": "http://localhost:8080/img1234567890/photo.png"
    }
  ],
  "idToken": "[NEW_ID_TOKEN]",
  "refreshToken": "[NEW_REFRESH_TOKEN]",
  "expiresIn": "3600"
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

Common Error Codes

Returned Message	Description
`INVALID_ID_TOKEN`	The user's credential is no longer valid. The user must sign in again.

GET USER DATA

You can get a user's data by issuing an HTTP POST request to the Auth getAccountInfo endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/getAccountInfo?key=[API_KEY]`

Request Body Payload

Property Name	Type	Description
`idToken`	string	The Firebase ID token of the account.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#GetAccountInfoResponse"`.
`users`	(List of JSON objects)	The account associated with the given Firebase ID token. Check below for more details.

Response Payload Users Array Content

Property Name	Type	Description
`localId`	string	The uid of the current user.
`email`	string	The email of the account.
`emailVerified`	boolean	Whether or not the account's email has been verified.
`displayName`	string	The display name for the account.
`providerUserInfo`	(List of JSON objects)	List of all linked provider objects which contain `"providerId"` and `"federatedId"`.
`photoUrl`	string	The photo Url for the account.
`passwordHash`	string	Hash version of password.
`passwordUpdatedAt`	(double)	The timestamp, in milliseconds, that the account password was last changed.
`validSince`	string	The timestamp, in seconds, which marks a boundary, before which Firebase ID token are considered revoked.
`disabled`	boolean	Whether the account is disabled or not.
`lastLoginAt`	string	The timestamp, in milliseconds, that the account last logged in at.
`createdAt`	string	The timestamp, in milliseconds, that the account was created at.
`customAuth`	boolean	Whether the account is authenticated by the developer.

A successful request is indicated by a 200 OK HTTP status code. The response will contain all the user information associated with the account.

Sample Response

{
  "kind": "identitytoolkit#GetAccountInfoResponse",
  "users": [
    {
      "localId": "ZY1rJK0...",
      "email": "user@example.com",
      "emailVerified": false,
      "displayName": "John Doe",
      "providerUserInfo": [
        {
          "providerId": "password",
          "displayName": "John Doe",
          "photoUrl": "http://localhost:8080/img1234567890/photo.png",
          "federatedId": "user@example.com",
          "email": "user@example.com",
          "rawId": "user@example.com",
          "screenName": "user@example.com"
        }
      ],
      "photoUrl": "https://lh5.googleusercontent.com/.../photo.jpg",
      "passwordHash": "...",
      "passwordUpdatedAt": 1.484124177E12,
      "validSince": "1484124177",
      "disabled": false,
      "lastLoginAt": "1484628946000",
      "createdAt": "1484124142000",
      "customAuth": false
    }
  ]
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

Common Error Codes

Returned Message	Description
`INVALID_ID_TOKEN`	The user's credential is no longer valid. The user must sign in again.
`USER_NOT_FOUND`	There is no user record corresponding to this identifier. The user may have been deleted.

LINK WITH EMAIL/PASSWORD

You can link an email/password to a current user by issuing an HTTP POST request to the Auth setAccountInfo endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/setAccountInfo?key=[API_KEY]`

Request Body Payload

Property Name	Type	Description
`idToken`	string	The Firebase ID token of the account you are trying to link the credential to.
`email`	string	The email to link to the account.
`password`	string	The new password of the account.
`returnSecureToken`	string	Whether or not to return an ID and refresh token. Should always be true.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#SetAccountInfoResponse"`.
`localId`	string	The uid of the current user.
`email`	string	The email of the account.
`displayName`	string	The display name for the account.
`photoUrl`	string	The photo Url for the account.
`passwordHash`	string	Hash version of password.
`providerUserInfo`	List of JSON objects	List of all linked provider objects which contain `"providerId"` and `"federatedId"`.
`emailVerified`	boolean	Whether or not the account's email has been verified.
`idToken`	string	New Firebase Auth ID token for user.
`refreshToken`	string	A Firebase Auth refresh token.
`expiresIn`	string	The number of seconds in which the ID token expires.

A successful request is indicated by a 200 OK HTTP status code. The response contains the Firebase ID token and refresh token associated with the authenticated user.

Sample Response

{
  "kind": "identitytoolkit#SetAccountInfoResponse",
  "localId": "huDwUz...",
  "email": "user@example.com",
  "displayName": "John Doe",
  "photoUrl": "https://lh5.googleusercontent.com/.../photo.jpg",
  "passwordHash": "...",
  "providerUserInfo": [
    {
      "providerId": "password",
      "federatedId": "user@example.com"
    }
  ],
  "idToken": "[ID_TOKEN]",
  "refreshToken": "[REFRESH_TOKEN]",
  "expiresIn": "3600",
  "emailVerified": false
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

Common Error Codes

Returned Message	Description
`CREDENTIAL_TOO_OLD_LOGIN_AGAIN`	The user's credential is no longer valid. The user must sign in again.
`TOKEN_EXPIRED`	The user's credential is no longer valid. The user must sign in again.
`INVALID_ID_TOKEN`	The user's credential is no longer valid. The user must sign in again.
`WEAK_PASSWORD`	The password must be 6 characters long or more.

LINK WITH OAUTH CREDENTIAL

You can link an OAuth credential to a user by issuing an HTTP POST request to the Auth verifyAssertion endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/verifyAssertion?key=[API_KEY]`

Request Body Payload

Property Name	Type	Description
`idToken`	string	The Firebase ID token of the account you are trying to link the credential to.
`requestUri`	string	The URI to which the IDP redirects the user back.
`postBody`	string	Contains the OAuth credential (an ID token or access token) and provider ID which issues the credential.
`returnSecureToken`	boolean	Whether or not to return an ID and refresh token. Should always be true.
`returnIdpCredential`	boolean	Whether to force the return of the OAuth credential on the following errors: `FEDERATED_USER_ID_ALREADY_LINKED` and `EMAIL_EXISTS`.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#VerifyAssertionResponse"`.
`federatedId`	string	The unique ID identifies the IdP account.
`providerId`	string	The linked provider ID (e.g. "google.com" for the Google provider).
`localId`	string	The uid of the authenticated user.
`emailVerified`	boolean	Whether the signin email is verified.
`email`	string	The email of the account.
`oauthIdToken`	string	The OIDC id token if available.
`oauthAccessToken`	string	The OAuth access token if available.
`oauthTokenSecret`	string	The OAuth 1.0 token secret if available.
`rawUserInfo`	string	The stringified JSON response containing all the IdP data corresponding to the provided OAuth credential.
`firstName`	string	The first name for the account.
`lastName`	string	The last name for the account.
`fullName`	string	The full name for the account.
`displayName`	string	The display name for the account.
`photoUrl`	string	The photo Url for the account.
`idToken`	string	A Firebase Auth ID token for the authenticated user.
`refreshToken`	string	A Firebase Auth refresh token for the authenticated user.
`expiresIn`	string	The number of seconds in which the ID token expires.

A successful request is indicated by a 200 OK HTTP status code. The response contains the Firebase ID token and refresh token associated with the authenticated user.

Sample response with OAuth ID token

{
  "kind": "identitytoolkit#VerifyAssertionResponse",
  "federatedId": "https://accounts.google.com/1234567890",
  "providerId": "google.com",
  "localId": "5xwsPCWYo...",
  "emailVerified": true,
  "email": "user@example.com",
  "oauthIdToken": "[GOOGLE_ID_TOKEN]",
  "firstName": "John",
  "lastName": "Doe",
  "fullName": "John Doe",
  "displayName": "John Doe",
  "idToken": "[ID_TOKEN]",
  "photoUrl": "https://lh5.googleusercontent.com/.../photo.jpg",
  "refreshToken": "[REFRESH_TOKEN]",
  "expiresIn": "3600",
  "rawUserInfo": "{\"updated_time\":\"2017-02-22T01:10:57+0000\",\"gender\":\"male\", ...}"
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

A successful request is indicated by a 200 OK HTTP status code. The response contains the Firebase ID token and refresh token associated with the authenticated user.

Sample response with OAuth access token

{
  "kind": "identitytoolkit#VerifyAssertionResponse",
  "federatedId": "http://facebook.com/1234567890",
  "providerId": "facebook.com",
  "localId": "5xwsPCWYo...",
  "emailVerified": true,
  "email": "user@example.com",
  "oauthAccessToken": "[FACEBOOK_ACCESS_TOKEN]",
  "firstName": "John",
  "lastName": "Doe",
  "fullName": "John Doe",
  "displayName": "John Doe",
  "idToken": "[ID_TOKEN]",
  "photoUrl": "https://scontent.xx.fbcdn.net/v/...",
  "refreshToken": "[REFRESH_TOKEN]",
  "expiresIn": "3600",
  "rawUserInfo": "{\"updated_time\":\"2017-02-22T01:10:57+0000\",\"gender\":\"male\", ...}"
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

A successful request is indicated by a 200 OK HTTP status code. The response contains the Firebase ID token and refresh token associated with the authenticated user.

Sample response with Twitter OAuth 1.0 credential

{
  "kind": "identitytoolkit#VerifyAssertionResponse",
  "federatedId": "http://twitter.com/1234567890",
  "providerId": "twitter.com",
  "localId": "5xwsPCWYo...",
  "emailVerified": true,
  "email": "user@example.com",
  "oauthAccessToken": "[OAUTH_ACCESS_TOKEN]",
  "oauthTokenSecret": "[OAUTH_TOKEN_SECRET]",
  "firstName": "John",
  "lastName": "Doe",
  "fullName": "John Doe",
  "displayName": "John Doe",
  "idToken": "[ID_TOKEN]",
  "photoUrl": "http://abs.twimg.com/sticky/...",
  "refreshToken": "[REFRESH_TOKEN]",
  "expiresIn": "3600",
  "rawUserInfo": "{\"updated_time\":\"2017-02-22T01:10:57+0000\",\"gender\":\"male\", ...}"
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

Common Error Codes

Returned Message	Description
`OPERATION_NOT_ALLOWED`	The corresponding provider is disabled for this project.
`INVALID_IDP_RESPONSE`	The supplied auth credential is malformed or has expired.
`INVALID_ID_TOKEN`	The user's credential is no longer valid. The user must sign in again.
`EMAIL_EXISTS`	The email address is already in use by another account.
`FEDERATED_USER_ID_ALREADY_LINKED`	This credential is already associated with a different user account.

UNLINK PROVIDER

You can unlink a provider from a current user by issuing an HTTP POST request to the Auth setAccountInfo endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/setAccountInfo?key=[API_KEY]`

Request Body Payload

Property Name	Type	Description
`idToken`	string	The Firebase ID token of the account.
`deleteProvider List of strings The list of provider IDs to unlink, eg: 'google.com', 'password', etc.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#SetAccountInfoResponse"`.
`localId`	string	The uid of the current user.
`email`	string	The email of the account.
`displayName`	string	The display name for the account.
`photoUrl`	string	The photo Url for the account.
`passwordHash`	string	Hash version of the password.
`providerUserInfo`	List of JSON objects	List of all linked provider objects which contain `"providerId"` and `"federatedId"`.
`emailVerified`	boolean	Whether or not the account's email has been verified.

A successful request is indicated by a 200 OK HTTP status code.

Sample Response

{
  "kind": "identitytoolkit#SetAccountInfoResponse",
  "localId": "huDwUz...",
  "email": "user@example.com",
  "displayName": "John Doe",
  "photoUrl": "https://lh5.googleusercontent.com/.../photo.jpg",
  "passwordHash": "...",
  "providerUserInfo": [
    {
      "providerId": "google.com",
      "federatedId": "1234567890",
      "displayName": "John Doe",
      "photoUrl": "https://lh5.googleusercontent.com/.../photo.jpg"
    },
    {
      "providerId": "password",
      "federatedId": "user@example.com"
    }
  ],
  "emailVerified": "true"
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

Common Error Codes

Returned Message	Description
`INVALID_ID_TOKEN`	The user's credential is no longer valid. The user must sign in again.

SEND EMAIL VERIFICATION

You can send an email verification for the current user by issuing an HTTP POST request to the Auth getOobConfirmationCode endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/getOobConfirmationCode?key=[API_KEY]`

Optional Headers

Property Name	Description
`X-Firebase-Locale`	The language code corresponding to the user's locale. Passing this will localize the email verification sent to the user.

Request Body Payload

Property Name	Type	Description
`requestType`	string	The type of confirmation code to send. Should always be `"VERIFY_EMAIL"`.
`idToken`	string	The Firebase ID token of the user to verify.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#GetOobConfirmationCodeResponse"`.
`email`	string	The email of the account.

A successful request is indicated by a 200 OK HTTP status code.

Sample Response

{
  "kind": "identitytoolkit#GetOobConfirmationCodeResponse",
  "email": "user@example.com"
}

1
2
3
4

Common Error Codes

Returned Message	Description
`INVALID_ID_TOKEN`	The user's credential is no longer valid. The user must sign in again.
`USER_NOT_FOUND`	There is no user record corresponding to this identifier. The user may have been deleted.

CONFIRM EMAIL VERIFICATION

You can confirm an email verification code by issuing an HTTP POST request to the Auth setAccountInfo endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/setAccountInfo?key=[API_KEY]`

Request Body Payload

Property Name	Type	Description
`oobCode`	string	The action code sent to user's email for email verification.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#SetAccountInfoResponse"`.
`email`	string	The email of the account.
`displayName`	string	The display name for the account.
`photoUrl`	string	The photo Url for the account.
`passwordHash`	string	The password hash.
`providerUserInfo`	(List of JSON objects)	List of all linked provider objects which contain `"providerId"` and `"federatedId"`.
`emailVerified`	boolean	Whether or not the account's email has been verified.

A successful request is indicated by a 200 OK HTTP status code.

Sample response

{
  "kind": "identitytoolkit#SetAccountInfoResponse",
  "localId": "FhyStE...",
  "email": "user@example.com",
  "passwordHash": "...",
  "providerUserInfo": [
    {
      "providerId": "password",
      "federatedId": "user@example.com"
    }
  ]
}

1
2
3
4
5
6
7
8
9
10
11
12

Common Error Codes

Returned Message	Description
`EXPIRED_OOB_CODE`	The action code has expired.
`INVALID_OOB_CODE`	The action code is invalid. This can happen if the code is malformed, expired, or has already been used.
`USER_DISABLED`	The user account has been disabled by an administrator.
`EMAIL_NOT_FOUND`	There is no user record corresponding to this identifier. The user may have been deleted.

DELETE ACCOUNT

You can delete a current user by issuing an HTTP POST request to the Auth deleteAccount endpoint.

Property Name	Description
Method:	`POST`
Content-Type:	`application/json`
Endpoint:	`[FB_URL]/deleteAccount?key=[API_KEY]`

Request Body Payload

Property Name	Type	Description
`idToken`	string	The Firebase ID token of the user to delete.

Response Payload

Property Name	Type	Description
`kind`	string	The request type, always `"identitytoolkit#DeleteAccountResponse"`.

A successful request is indicated by a 200 OK HTTP status code.

Sample Response

{
  "kind": "identitytoolkit#DeleteAccountResponse"
}

1
2
3

Common Error Codes

Returned Message	Description
`INVALID_ID_TOKEN`	The user's credential is no longer valid. The user must sign in again.
`USER_NOT_FOUND`	There is no user record corresponding to this identifier. The user may have been deleted.

← Firebase Basics Firebase Auth →

¶ Firebase REST

¶ AUTHENTICATION

¶ SIGN UP WITH EMAIL / PASSWORD

¶ Request Body Payload

¶ Response Payload

¶ Sample Response

¶ Common Error Codes

¶ LOGIN / SIGN IN WITH EMAIL & PASSWORD

¶ Request Body Payload

¶ Response Payload

¶ Sample response

¶ Common Error Codes

¶ RESULT - LOGIN (VALID USER)

¶ RESULT - LOGIN (INVALID EMAIL)

¶ RESULT - LOGIN (MISSING PASSWORD)

¶ RESULT - LOGIN (INVALID PASSWORD)

¶ LOGIN - EMAIL NOT FOUND (UNREGISTERED)

¶ SIGN IN WITH OAUTH CREDENTIAL

¶ Request Body Payload

¶ Response Payload

¶ Sample response with OAuth ID token

¶ Sample response with OAuth access token

¶ Sample response with Twitter OAuth 1.0 credential

¶ Common Error Codes

¶ FETCH PROVIDERS FOR EMAIL

¶ Request Body Payload

¶ Response Payload

¶ Sample response

¶ Common Error Codes

¶ SEND PASSWORD RESET EMAIL

¶ Optional Headers

¶ Request Body Payload

¶ Response Payload

¶ Sample Response

¶ Common Error Codes

¶ VERIFY PASSWORD RESET CODE

¶ Request Body Payload

¶ Response Payload

¶ Sample response

¶ Common Error Codes

¶ CONFIRM PASSWORD RESET

¶ Request Body Payload

¶ Response Payload

¶ Sample Response

¶ Common Error Codes

¶ CHANGE EMAIL

¶ Optional Headers

¶ Request Body Payload

¶ Response Payload

¶ Sample response

¶ Common Error Codes

¶ CHANGE PASSWORD

¶ Request Body Payload

¶ Response Payload

¶ Sample Response

¶ Common Error Codes

¶ UPDATE PROFILE

¶ Request Body Payload

¶ Response Payload

¶ Sample Response

¶ Common Error Codes

¶ GET USER DATA

¶ Request Body Payload

¶ Response Payload

¶ Response Payload Users Array Content

¶ Sample Response

¶ Common Error Codes

¶ LINK WITH EMAIL/PASSWORD

¶ Request Body Payload

¶ Response Payload

¶ Sample Response

¶ Common Error Codes

¶ LINK WITH OAUTH CREDENTIAL

¶ Request Body Payload

¶ Response Payload

¶ Sample response with OAuth ID token

¶ Sample response with OAuth access token

¶ Sample response with Twitter OAuth 1.0 credential

¶ Common Error Codes

¶ UNLINK PROVIDER

Firebase REST

AUTHENTICATION

SIGN UP WITH EMAIL / PASSWORD

Request Body Payload

Response Payload

Sample Response

Common Error Codes

LOGIN / SIGN IN WITH EMAIL & PASSWORD

Request Body Payload

Response Payload

Sample response

Common Error Codes

RESULT - LOGIN (VALID USER)

RESULT - LOGIN (INVALID EMAIL)

RESULT - LOGIN (MISSING PASSWORD)

RESULT - LOGIN (INVALID PASSWORD)

LOGIN - EMAIL NOT FOUND (UNREGISTERED)

SIGN IN WITH OAUTH CREDENTIAL

Request Body Payload

Response Payload

Sample response with OAuth ID token

Sample response with OAuth access token

Sample response with Twitter OAuth 1.0 credential

Common Error Codes

FETCH PROVIDERS FOR EMAIL

Request Body Payload

Response Payload

Sample response

Common Error Codes

SEND PASSWORD RESET EMAIL

Optional Headers

Request Body Payload

Response Payload

Sample Response

Common Error Codes

VERIFY PASSWORD RESET CODE

Request Body Payload

Response Payload

Sample response

Common Error Codes

CONFIRM PASSWORD RESET

Request Body Payload

Response Payload

Sample Response

Common Error Codes

CHANGE EMAIL

Optional Headers

Request Body Payload

Response Payload

Sample response

Common Error Codes

CHANGE PASSWORD

Request Body Payload

Response Payload

Sample Response

Common Error Codes

UPDATE PROFILE

Request Body Payload

Response Payload

Sample Response

Common Error Codes

GET USER DATA

Request Body Payload

Response Payload

Response Payload Users Array Content

Sample Response

Common Error Codes

LINK WITH EMAIL/PASSWORD

Request Body Payload

Response Payload

Sample Response

Common Error Codes

LINK WITH OAUTH CREDENTIAL

Request Body Payload

Response Payload

Sample response with OAuth ID token

Sample response with OAuth access token

Sample response with Twitter OAuth 1.0 credential

Common Error Codes

UNLINK PROVIDER