Skip to Content
IntegrationsFirebase

Firebase

KalamDB no longer has Firebase-specific auth configuration. Firebase now fits the same single-provider OIDC model as Dex, Keycloak, Okta, Auth0, Entra ID, Google, and other standards-compliant issuers.

Use the generic OIDC docs and set the issuer to your Firebase project issuer.

Example server.toml

TOML
[auth]jwt_trusted_issuers = "kalamdb,https://securetoken.google.com/YOUR_PROJECT_ID" [auth.oidc]enabled = truedisplay_name = "Firebase"issuer = "https://securetoken.google.com/YOUR_PROJECT_ID"client_id = "YOUR_PROJECT_ID"scopes = ["openid", "email", "profile"]auto_provision = truedefault_role = "user"

If you need explicit audience validation, keep client_id set to the Firebase project ID.

What Changed

Do not use or document these removed shapes anymore:

  • [oauth]
  • [oauth.providers.firebase]
  • provider-coded identities such as oidc:fbs:<subject>

Current external identities use the Firebase/OIDC sub claim directly as the KalamDB user_id.

If you need explicit persisted users or elevated roles, create them with issuer and subject:

SQL
CREATE USER 'FIREBASE_UID'  WITH OIDC '{"issuer":"https://securetoken.google.com/YOUR_PROJECT_ID","subject":"FIREBASE_UID"}'  ROLE dba  EMAIL 'user@example.com';
Last updated on
JaegerKeycloak