canonical: https://jentic.com/apis/firebase.google.com/firebase

# Google Firebase Auth REST API

This page describes a curated, agent-optimized Jentic OpenAPI specification for the Firebase Auth REST API, covering nine operations and kept validated and agent-ready. Google documents this surface in its REST reference and ships an API Discovery document for Identity Toolkit in Google's own Discovery format rather than OpenAPI, and a third-party OpenAPI conversion of the older Identity Toolkit v3 surface is published on APIs.guru; the FAQ below links all three. The Firebase Auth REST API exposes the Google Identity Toolkit so applications and agents can sign users up with email/password, sign them in with OAuth/IdP or custom tokens, look up and update account profiles, and trigger out-of-band emails for verification or password reset. The nine-endpoint surface is the same one mobile and web SDKs sit on top of, making it suitable when an SDK is not available - in agents, server-side flows, or cross-platform automations.

## For AI agents

Sign users up, sign them in with email/password or OAuth/IdP, look up and update accounts, and send verification or password-reset emails through the Firebase Identity Toolkit.

## Scope

Does not handle Firestore data, Realtime Database, push notifications, or Cloud Functions deploys - use for user authentication and account management only.

## Capabilities

- Register users with email and password through /accounts:signUp and receive an idToken and refreshToken
- Authenticate existing users with email/password through /accounts:signInWithPassword
- Sign in with federated identity providers (Google, Apple, etc.) via /accounts:signInWithIdp
- Exchange a server-minted custom token for a Firebase idToken via /accounts:signInWithCustomToken
- Look up account profiles by idToken or localId through /accounts:lookup
- Update account email, password, or display name with /accounts:update
- Send password-reset and email-verification messages through /accounts:sendOobCode

## Use cases

### Server-Side Email/Password Auth

Implement email/password signup and sign-in from a backend or agent runtime that cannot use the client SDK. POST /accounts:signUp creates the user, /accounts:signInWithPassword authenticates returning users, and /accounts:sendOobCode triggers verification and reset emails. A simple auth service is live in a few hours.

Example prompt: POST /accounts:signUp with email='alice@acme.com' and a generated password, then POST /accounts:sendOobCode to send a verification email to that address

### Federated Identity (Google, Apple, etc.)

Accept sign-in from federated identity providers by sending the IdP token to /accounts:signInWithIdp. Firebase verifies the IdP credential and returns its own idToken/refreshToken pair. Useful when an agent needs to act on behalf of a user authenticated via Google or Apple. Typically integrated in under a day per provider.

Example prompt: POST /accounts:signInWithIdp with postBody='id_token=GOOGLE_ID_TOKEN&providerId=google.com' and store the returned refreshToken for later session refresh

### Custom Token Exchange

Use the Firebase Admin SDK to mint a custom token for a user authenticated by your own backend, then exchange it for a real Firebase idToken via /accounts:signInWithCustomToken. This bridges legacy auth systems into Firebase-secured services. Setup is roughly half a day including Admin SDK key handling.

Example prompt: Mint a custom token for userId 'u_42' with the Admin SDK, then POST /accounts:signInWithCustomToken with the token to get a usable idToken

### AI Agent Identity Operations

Use Firebase Auth through Jentic so an agent can sign up users, send password-reset emails, or look up account state without managing the Identity Toolkit shape. Jentic exposes the nine endpoints as discoverable tools while keeping the API key in the vault, suitable for support-desk agents and onboarding bots. Get started with Jentic One, the self-hosted execution layer

Example prompt: Through Jentic, search 'send a password reset email', load the /accounts:sendOobCode schema, and execute with requestType=PASSWORD_RESET and email='user@example.com'

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /accounts:signUp | Sign up with email and password |
| POST | /accounts:signInWithPassword | Sign in with email and password |
| POST | /accounts:signInWithIdp | Sign in with OAuth or IdP |
| POST | /accounts:signInWithCustomToken | Exchange a custom token for an idToken |
| POST | /accounts:lookup | Look up user account data |
| POST | /accounts:update | Update account profile or password |
| POST | /accounts:delete | Delete an account |
| POST | /accounts:sendOobCode | Send verification or password-reset email |

## Key resources

- **Authentication** — Sign-up and sign-in endpoints for email/password, IdP, and custom tokens
- **Account Management** — Lookup, update, and delete account records and trigger OOB code emails

## Why Jentic

- **Setup:** Wiring the Firebase Auth REST API by hand means attaching the Web API key as a query parameter, passing end-user idTokens through the right accounts operations, and handling retries yourself. Through Jentic you install once, import Firebase Auth from the API Directory, store the key once, and your agent calls it.
- **Permission scoping:** Firebase Auth carries its target in the request body, such as an email or idToken, rather than as an owned resource in the URL path, so limit the agent to the operations it needs, such as sign-in or sending an out-of-band code, and leave account deletion out of the allowed set unless required. You choose which operations it may call.
- **Credential handling:** Your Firebase Web API key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'send a password reset email' or 'sign in with email and password', and Jentic returns the matching Identity Toolkit operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Firebase Hosting API** — Deploys the static site and channels that Firebase-authenticated users land on
- **Fire Financial Services Business API** — Adds business banking actions for an authenticated end user in a fintech app
- **Fitbit Web API** — Different identity model (OAuth2) - useful as the data layer behind a Firebase-authenticated user profile

## FAQ

### Which OpenAPI specification does this Firebase Auth REST API page describe?

A curated, agent-optimized Jentic OpenAPI specification covering 9 Firebase Auth operations, authored from Google's REST reference at https://firebase.google.com/docs/reference/rest/auth. Google's own structured artifact for this surface is an API Discovery document rather than an OpenAPI document: https://identitytoolkit.googleapis.com/$discovery/rest?version=v1 returns kind discovery#restDescription, revision 20260804, describing 41 methods including the accounts operations this page covers. Firebase is a family of separate APIs, so Google's official artifact is a document set rather than a single file, indexed at https://www.googleapis.com/discovery/v1/apis, which lists identitytoolkit v1, v2 and v3 plus 12 distinct firebase APIs across 19 document versions. A third-party OpenAPI 3.0.0 conversion of the legacy Identity Toolkit v3 surface, generated from Google's v3 Discovery document, is published at https://api.apis.guru/v2/specs/googleapis.com/identitytoolkit/v3/openapi.json. The Jentic variant targets the current v1 account operations with agent-facing descriptions and input schemas. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Firebase Auth REST API use?

The API uses an apiKey passed as the `key` query parameter on every call (the Web API key from the Firebase console). Through Jentic, the key sits in the encrypted vault and is appended at execution time. End-user credentials are still managed via the request body fields like email, password, or idToken.

### Can I sign users up with email and password using the Firebase Auth REST API?

Yes. POST /accounts:signUp accepts email and password and returns idToken, refreshToken, and localId. Pair with POST /accounts:sendOobCode (requestType=VERIFY_EMAIL) to trigger the email verification flow.

### What are the rate limits for the Firebase Auth REST API?

Identity Toolkit applies per-project quotas - typical defaults allow hundreds of requests per second per project, with per-IP throttling on signup and sign-in. The API returns standard 429 responses; check the Firebase console for project-specific limits.

### How do I send a password reset email through Jentic?

Search Jentic for 'send a password reset email', load the /accounts:sendOobCode schema, and execute with requestType=PASSWORD_RESET and the user's email. Firebase delivers the reset email using your project's email template.

### Can I use the Firebase Auth REST API server-side?

Yes - that is its primary use case. Mobile and web SDKs use it under the hood; calling it directly from a server or agent works well when an SDK is not available.

### Can I limit what my agent is allowed to do with the Firebase Auth REST API?

Yes. Because you run Jentic One yourself, your own rules decide which Firebase Auth operations and credentials the agent may use, and you can grant only the endpoints it needs, such as /accounts:signInWithPassword and /accounts:sendOobCode, while leaving /accounts:delete or /accounts:update out of the allowed set. Firebase Auth names its target in the request body through fields like email or idToken rather than in the URL path, so scoping is done per operation. Your Firebase Web API key is held by your own instance and injected only when a permitted call runs, never entering the agent's prompt or logs.