Weave Code
Firebase Tokens Laravel Package
kreait/firebase-tokens
A PHP library for working with Google Firebase tokens: create custom tokens and verify Firebase ID tokens and session cookies. It powers the Firebase Admin SDK for PHP and is downloaded over a million times monthly.
A PHP library to work with Firebase tokens
Frequently asked questions about Firebase Tokens
- How do I install kreait/firebase-tokens in a Laravel application?
- Install it with composer require kreait/firebase-tokens. The package has no Laravel-specific service provider, so you can use its classes directly or bind them in your own service provider. Credentials can be supplied through your Laravel .env file and config system.
- What can I do with kreait/firebase-tokens in Laravel?
- You can create Firebase custom tokens for authenticating users, verify Firebase ID tokens sent from client apps, and verify Firebase session cookies. These are the same capabilities that power the Firebase Admin SDK for PHP. Typical Laravel use cases include API authentication and server-side session validation.
- Does kreait/firebase-tokens work with Laravel's service container and dependency injection?
- Yes. The library is decoupled from any framework, and its classes such as the custom token generator and ID token verifier can be resolved through Laravel's service container. You can type-hint them in controllers, middleware, or jobs after binding them in a service provider. No framework-specific bootstrapping is required.
- Which Laravel and PHP versions are supported by kreait/firebase-tokens?
- The package requires a modern PHP version and follows Composer version constraints, so check the Packagist page and the composer.json for the exact PHP requirement. It is not tied to a specific Laravel version because it is framework-agnostic. Always verify that your Laravel app's PHP constraint satisfies the package requirement before upgrading.
- How do I configure Firebase credentials for kreait/firebase-tokens in Laravel?
- Store your Firebase service account credentials in your .env file or a secret manager, then reference them from a config file. Never commit credentials to source control. Because the library accepts credentials programmatically, Laravel's config system lets you switch between environments without code changes.
- Is there a security issue with FIREBASE_AUTH_EMULATOR_HOST in kreait/firebase-tokens?
- Versions before 5.6.2 could treat a whitespace-only FIREBASE_AUTH_EMULATOR_HOST value as enabled emulator mode, which skipped signature verification for ID tokens and session cookies. Release 5.6.2 hardens this behavior so whitespace-only values no longer enable emulator mode. Upgrading to 5.6.2 or later is strongly recommended, especially in production Laravel deployments.
- Can I cache Google's secure token store results in Laravel?
- Yes. The library supports PSR-6 cache implementations, and Laravel's cache component can be adapted to PSR-6 or you can use a PSR-6 compatible cache package. Caching verified public keys reduces calls to Google's secure token store. Configure a cache pool that fits your application's scaling needs.
- How do I test Firebase token verification in a Laravel application?
- Use Laravel's testing utilities to fake or mock the token verifier in your service container during tests. Add a test that fails if emulator mode is enabled outside local or test environments to guard against misconfiguration. This helps ensure auth flows behave correctly without contacting Google's servers.
- Does kreait/firebase-tokens have breaking changes when upgrading to 5.6.2?
- Release 5.6.2 is a patch release with no indicated breaking API changes, so a Composer update should be straightforward. Verify that your composer.lock and any transitive firebase-php dependency remain satisfied after updating. Local developers who relied on whitespace-only emulator host values must now set an explicit emulator host.
- Is kreait/firebase-tokens a good alternative to using the full Firebase Admin SDK in Laravel?
- It is the token-focused library that the Firebase Admin SDK for PHP itself uses, so it is ideal when you only need custom token creation or ID token and session cookie verification. If you need broader Firebase features like Realtime Database, Firestore, or Cloud Messaging, use kreait/firebase-php instead. The package is widely adopted with over a million monthly downloads and low ongoing maintenance.
Weaver
How can I help you explore Laravel packages today?