Firebase Authentication emulator configuration transition for cross-project testing

Firebase Authentication provides distinct development and testing configurations that require explicit alignment with production security boundaries. The local emulator simulates authentication flows using service account credentials, but its behavior regarding cross-project resource access and token validation differs from the live Auth API. This discrepancy creates uncertainty when integrating tests that must validate identity propagation without triggering production credential exposure.

Which service account permissions allow the emulator to accept federated identity tokens across project boundaries? How does the emulator's token lifetime policy compare to production Auth settings? What configuration flags reconcile development testing requirements with production compliance constraints?