Firebase verifyIdToken Error: Decoding Firebase ID token failed.

Question

I am trying to setup an Android app communicating with a NodeJS REST API that communicates with Firebase but it seems the firebase token does not work for me.

I'm running a local nodejs server and an Android simulation locally now to test it out and here is how it looks:

Android method:

@Override
public void onNewToken(String token) {
    Log.i(TAG, "Refreshed token: " + token);
    postRegistrationToken(token);
}

This correctly generates and sends to the REST API.

Log shows:

Refreshed token: "MY_TOKEN_STRING"

in NodeJS:

app.post('/api/token/get', (req, res) => {
const token = req.body.registrationToken;
LOG.info(`Acquired token: ${token}`);
admin.auth().verifyIdToken(token)
    .then((decodedToken) => {
        LOG.info(`Successfully validated registrationToken ${token}`);
        //stuff
    })
    .catch((err) => {
        LOG.error(err)
    });
});

The verifyIdToken fails but the token is the same that was generated in the Android client:

Acquired token: "MY_TOKEN_STRING"
Error: Decoding Firebase ID token failed.
 Make sure you passed the entire string JWT which represents an ID token.
 See https://firebase.google.com/docs/auth/admin/verify-id-tokens for details on how to retrieve an ID token.

I tried to validate the token in a JWT validator website like https://www.jsonwebtoken.io/ but they say it's an invalid signature.

Am I missing something or what could be wrong?

Answer 1

You seem to be getting the Firebase Instance ID token (also known as an FCM token) on the client, and then trying to verify that it's a valid Firebase Authentication ID token.

• An FCM Token/Instance ID token identifies an installation of a specific app on a specific device. It does not identify a specific user.
• A Auth ID token identifies a specific user of a specific app/project. It does not identify a specific device.

The two tokens are quite different and serve different purposes, and the Authentication Admin SDK correctly fails to verify the FCM token.

To get the an Firebase Authentication ID token, you should call FirebaseUser.getIdToken(). For an example of this, see the documentation on getting an ID token.