Firebase custom claims as feature flags
How to use Firebase Auth custom claims as server‑driven feature flags, with a concrete Admin SDK setup, client consumption, and propagation considerations.
Loading…
ReadMeFeed / Community knowledge
#custom-claims
Real questions. Useful conversations. Find the people who know your stack.
firebaseFirestore Security Rules with Custom Claims: Role-Based Access Control in Firebase
Use Firebase Auth custom claims to embed roles in ID tokens, then enforce access in Firestore security rules via request.auth.token.role—avoiding extra document reads and quota costs. Includes Admin SDK setup, rule patterns, emulator testing, and deployment rollback.
Firestore Security Rules: Enforcing a Revocation Boundary for Revoked Sessions
Goal Enforce least-privilege in Firestore Security Rules so a revoked session — say, after a password reset handled with the Admin SDK's refresh-token revocation — stops authorizing reads and writes immediately instead of up to an hour later. Constraints ID tokens are short-lived JWTs that the client SDKs refresh automatically; a token generally stays valid