Search code examples
firebasefirebase-authenticationgoogle-identity-toolkit

Is there a way to sign a Firebase custom token using a service account from a different project

I would like to use signInWithCustomToken to a secondary project using a token signed by a service account from a primary project.

At the moment I get "Error: The custom token corresponds to a different audience."

I was hoping that adding the signing service account to the secondary project with the Role: Service Account Token Creator would be enough to accept its tokens but it is not.

Is there anything else I can do to get this setup to work?

Solution

  • I think the answer is "it is not possible". See statement from a Firebase team member

    "A service account can only sign tokens for one and only one project. Any token signed by service account Foo is only valid within the parent project of Foo." -- hiranya911

    https://github.com/firebase/firebase-admin-node/issues/634#issuecomment-525953070