Firebase rules, using third party token?

Question

I am using the Firebase database and Okta for authentication.

It is my first time diving into rules but currently, it stores the access token on the browser then redirects to the web app. How can correctly enforce this rule so that anyone with this token can read/write?

Current rules:

{
  "rules": {
    ".read": true,
    ".write": true
  }
}

Answer 1

Firebase security rules can be used with Firebase Authentication only if you are trying to access information of user reading/updating database. One way would be to make requests througha Cloud function, verify Okta token there and then return data if authorized.