Firebase ID token to secure API (Google Cloud Endpoints)

Question

I have an API that I want to secure, I'm thinking of use Firebase ID tokens and include a token in every request, using:

firebase.auth().currentUser.getToken(/* forceRefresh */ true).then(function(idToken) {
        // Send token to your backend via HTTPS
    }).catch(function(error) {
        // Handle error
    });

and then verify the token.

Could this slow down the request to the API?

You don't need to force a refresh on each call. getToken will cache the valid token and only refresh it if it is expired. This may optimize things for you. — bojeil

saiyr saiyr · Accepted Answer · 2016-09-08T18:29:47

The answer is of course, yes, authentication will always slow down the request to the API. But it should be pretty minimal.

Firebase ID token to secure API (Google Cloud Endpoints)

1 Answers