FireBase Rest with auth query param not working

Question

   // INIT FIREBASE
    FirebaseOptions options = new FirebaseOptions.Builder()
          .setServiceAccount(new FileInputStream("C:\\path\\testcustom-dff2147d3b14.json"))
          .setDatabaseUrl("https://testcustom-a1a4d.firebaseio.com/")
          .build();
        FirebaseApp.initializeApp(options);
        isFireBaseInit = true;

       // GENERATE TOKEN
        String uid = "USER ID SOME RANDOM";
        HashMap<String, Object> additionalClaims = new HashMap<String, Object>();
        String token = FirebaseAuth.getInstance().createCustomToken(uid, additionalClaims);

Not from browser if i try to use rest api to fetch data

https://testcustom-a1a4d.firebaseio.com/1719126/1719130/1719121.json?auth=TOKEN GENERATOR IN JAVA CODE

I get following error:

{
  "error" : "Missing claim 'kid' in auth header."
}

What am i doing wrong?

Does custom token doesnot work with rest api. DO i need to use firebase link , If yes how to add additional claim in it ?

PS: firebase sdk version i am using

com.google.firebase firebase-server-sdk 3.0.1

EDIT: THERE IS A INCONSISTENCY IN FIREBASE DOCUMENTATION

---

FIREBASE GUIDE DOCUMENTATION SAYS

The argument can either be your Firebase app's secret or an authentication token, as described in the "Users in Firebase Projects"

Type of authentication described are https://firebase.google.com/docs/auth/users#auth_tokens
Note: custom token is present there

---

FIREBASE REFERENCE DOCUMENTATION SAYS

The argument can either be your Firebase app's secret or an authentication token. See the REST authentication documentation for details.

---

So Guide and reference talk differently.

Need help please

Answer 1

From firebase support team

Yes, creating custom tokens using FirebaseAuth.getInstance().createCustomToken(uid, additionalClaims) does not work with REST API. These tokens are designed to be used by client SDKs with signInWithCustomToken(token). Please note that "client to DB" REST requests are not supported right now due to changes in security model in the new Firebase (legacy Firebase supports it).

As you have pointed out, you need to follow this link in order to make an authenticated REST request. You should to use the access_token parameter, passing the token derived from the service account private key. This assumes you're scenario is "Server to DB" as you're using a service account.

To add custom claims using REST, you should use the auth_variable_override parameter. See here. Your request should now look like this with the added claim: {"uid":"6LiF16Dm0hNB9XO61UR1KM5Jeun2"}

$ curl " https://test-de98f.firebaseio.com/test.json?access_token= &auth_variable_override=%7B%22uid%22%3A%226LiF16Dm0hNB9XO61UR1KM5Jeun2%22%7D" {" 1213314":{"alanisawesome":"Alan Turing"}}

I do understand that the documentation you have pointed out needs to be improved and have raised this to our documentation team so that it could be prioritized appropriately. Though, I can't share any timelines as of the moment.

Hope this helps. Feel free to respond for any more issues or concerns.