Firebase Auth skill: firebase-auth-basics explained

Source: firebase/agent-skills · Maintainer: Firebase (Google) · License: Apache-2.0 · Checked: 24 October 2026

What is the Firebase Auth skill?

firebase-auth-basics is Firebase's official Agent Skill for Firebase Authentication. It teaches a coding agent to turn on sign-in providers, add sign-in code to web, Android, iOS and Flutter apps, and lock down data with request.auth in Security Rules.

Its SKILL.md description reads: "Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules." The frontmatter lists Google LLC as author and Identity as the category.

Firebase's agent skills page describes it as a skill that "Helps you implement secure sign-in with Firebase Authentication, manage your user base, and protect your data using authentication-based Security Rules." The skill name is the same in Firebase's docs, the repo folder and skills.sh.

As of 24 October 2026, its skills.sh page listed 173.9K installs (snapshot, 24 October 2026), second only to firebase-basics in the repo.

What does it do?

The SKILL.md has three parts: prerequisites, core concepts and a workflow.

Prerequisites. It expects a Firebase project and a logged-in Firebase CLI, and points to firebase-basics for both. The skill's compatibility note says it "is best used with the Firebase CLI, but does not require it."

Core concepts it gives the agent:

• Users. Each user has a uid that is unique across providers, plus email, displayName, photoURL and emailVerified.
• Providers. Email and password, federated providers (Google, Facebook, Twitter, GitHub, Microsoft, Apple), phone number, anonymous and custom auth. The skill calls Google Sign In "a good and secure default provider."
• Tokens. A short-lived ID token and a long-lived refresh token. Firebase's session docs confirm that ID tokens "are short lived and last for an hour; the refresh token can be used to retrieve new ID tokens."

Workflow:

1. Provisioning. For Google Sign-In, email and password, and anonymous auth, the agent adds an auth block to firebase.json and runs npx -y firebase-tools@latest deploy --only auth. Firebase's CLI provider docs describe the same firebase.json approach and the same three providers. Anything else goes through the Firebase console.
2. Client setup. The agent reads the reference file for your platform.
3. Security Rules. It uses request.auth in Firestore or Storage rules.

The skill marks the deploy step as critical: provider changes in firebase.json do nothing until they are deployed, and deploying is what creates the OAuth clients your app platforms need.

What's in the folder:

• SKILL.md: concepts and the workflow above.
• references/client_sdk_web.md: web SDK setup, emulator connection, email and password, popup sign-in for Google, Facebook, Apple, Twitter, GitHub, Microsoft and Yahoo, anonymous sign-in, email link sign-in, auth state and sign-out.
• references/client_sdk_android.md: Kotlin setup, including Jetpack Compose, with curl commands that read the latest Firebase BoM and Auth versions from Google's Maven repository.
• references/ios_setup.md: Swift setup with async sign-up and sign-in.
• references/flutter_setup.md: Flutter notes on google_sign_in 7.2.0 API changes, web crashes on startup and logout, an AuthService template and the unauthorized-domain error.
• references/security_rules.md: request.auth checks for signed-in users, owners and verified emails.

How do you install the Firebase Auth skill?

Firebase's agent skills docs install the whole Firebase set per tool. Pick one route per agent.

Claude Code plugin (all Firebase skills plus the MCP server):

claude plugin marketplace add firebase/agent-skills
claude plugin install firebase@firebase

Codex plugin:

codex plugin marketplace add firebase/agent-skills
codex plugin add firebase@firebase

Cursor:

npx skills add firebase/agent-skills --agent=cursor

Just this skill, using the command from skills.sh:

npx skills add https://github.com/firebase/agent-skills --skill firebase-auth-basics

If you install it alone, add firebase-basics too, since this skill sends the agent there for project setup and CLI login. For where Codex and Cursor read skill folders, see Codex skills and Cursor skills. Claude Code reads skills from ~/.claude/skills/ or .claude/skills/ in a project, as its skills docs explain, and plugins are covered in Claude Code plugins.

How do you use it?

The skill loads when you ask for sign-in, user accounts or auth-based access rules. You can also call it by name in agents that support that, for example /firebase-auth-basics in Claude Code.

Example prompts (suggestions, not quotes from the repo):

• Add Google sign-in and email/password login to this React app with Firebase Auth. Configure the providers in firebase.json and deploy them.
• Let visitors try the app anonymously, then link their account to Google when they sign up.
• Add Sign in with Apple to the iOS app. Tell me which steps I have to do in the Firebase console.
• Write Firestore rules so each user can only read and write documents under /users/{their uid}.
• My Flutter web Google sign-in popup closes right away with unauthorized-domain. Fix it.

For providers the CLI cannot enable, expect the agent to send you to the Authentication providers screen in the console rather than trying a workaround.

Tips and limits

• Snyk audit: Warn (8 October 2026). On skills.sh, Gen Agent Trust Hub and Socket show Pass and Snyk shows Warn at medium risk, with one finding, W011 "Third-party content exposure detected (indirect prompt injection risk)." Snyk rates it low risk (0.10) and ties it to the Android reference, which has the agent fetch Maven metadata XML from Google with curl to look up SDK versions.
• Three providers by CLI, the rest by console. Only Google Sign-In, email and password, and anonymous auth can be set in firebase.json. Apple, GitHub, Facebook, Microsoft, phone and others still need the console.
• No port numbers in redirect URIs. The skill warns that http://localhost:9090 in authorizedRedirectUris makes the auth deploy fail with INVALID_AUTHORIZED_DOMAIN. Use http://localhost.
• Rules are a hand-off. The rules reference covers request.auth patterns only. For full Firestore rules it points to the firestore-rules-creation skill, and for Storage rules to a firebase-storage-basics skill that has no folder in the repo today.
• Unpinned CLI. Like the other Firebase skills, it runs npx -y firebase-tools@latest, so each run pulls the newest CLI from npm.

Under Apache 2.0 you can copy and modify the skill as long as you keep the license and notices and mark files you change.

Save it in your Kipt library

In Kipt, open Skills and paste the skill's GitHub folder link to import it with its references/ files. Paste the repo link instead and Kipt lists every Firebase skill so you can pick firebase-basics alongside it. Kipt keeps your skills in your own private GitHub repo and installs them into Claude Code or Codex with one command:

npx skills add https://github.com/<you>/<repo>.git --all -g

Kipt is not affiliated with Firebase or Google.

Similar skills

• firebase-basics: the Firebase CLI, login and project setup this skill depends on.
• Firebase Hosting skill: deploy the static site or SPA your sign-in lives in.
• Better Auth skill: best practices if you run your own auth instead of Firebase Authentication.
• Supabase skill: Supabase's official skill, which covers Supabase Auth alongside Postgres.