Firebase tools: login as service account

14
votes

I cannot find way how to deploy firebase project (functions) on behalf of service account.

Nothing is said both on documentation page and also I found nothing related in their bug tracker.

As described, I run firebase login:ci command but then I need to login myself - and I want login as service account.

Such feature is available using gcloud tool, but, as stated in docs,

Cloud Functions written using the Firebase SDK for Cloud Functions can't be deployed using the gcloud command-line tool, and vice-versa.

3
node.jsfirebasegoogle-cloud-functionsfirebase-tools
Since the documentation explicitly says that this isn't possible, what is your question? – Frank van Puffelen
Documentation says that it is impossible use gcloud tool to deploy cloud functions written using firebase SDK. It doesn't say that deployment using firebase-tools on behalf of service account is impossible. I hope there should be some way – Serge

3 Answers

13
votes

firebaser here

Since version 7.1 of the Firebase CLI/tools it is possible to authenticate with a service account.

Also see Michael's answer here: Login to firebase using gcloud service account

Previous answer:

To use the Firebase CLI/tools you need to be signed in as an actual user. There is no way to run the Firebase CLI as a service account.

It's been noted as a valid and interesting feature request though! Some work that might help towards this feature is being done in this PR. As usual: no commits on if/when/how this may land. Keep an eye on the release notes for the latest updates.

5
votes

This works:

$> gcloud iam service-accounts keys create ./secrets.json --iam-account=<SERVICE_ACCOUNT_EMAIL>

$> export GOOGLE_APPLICATION_CREDENTIALS="./secrets.json"

$> firebase deploy --project <PROJECT_ID>
4
votes

You can actually use the refresh token of a Google account (service account or otherwise) that has access to Firebase roles, and set it to the FIREBASE_TOKEN environment variable.

For example I use Cloud Build (which has an associated service account that is already logged into gcloud) and then set FIREBASE_TOKEN to the output of gcloud auth application-default print-access-token.