firebase-auth-setup

What This Skill Does

The firebase-auth-setup skill is a specialized OpenClaw agent capability designed to bootstrap, maintain, and secure Firebase Authentication within Next.js App Router applications. It streamlines the complex task of integrating identity providers, managing Firebase Admin SDK configurations, and implementing server-side route protection. By adhering to a mandatory security-first Planning Protocol, the skill ensures that developers avoid common pitfalls such as session leakage, improper middleware configuration, and state synchronization issues between Firebase and Supabase. The skill covers the end-to-end implementation of authentication, including configuring React auth hooks, managing custom claims for RBAC, and setting up middleware that verifies JWTs via Firebase Admin.

Installation

To integrate this skill into your environment, run the following command in your terminal within your project root: clawhub install openclaw/skills/skills/guifav/firebase-auth-setup

Use Cases

• Initial Project Setup: Rapidly scaffold a secure authentication architecture using Firebase and Next.js.
• Provider Expansion: Integrate additional OAuth providers like Apple, GitHub, or Microsoft into an existing application without breaking current RLS or middleware logic.
• Supabase Syncing: Implement robust user profile synchronization where Firebase UIDs are mapped to Supabase database rows, maintaining referential integrity across the stack.
• Access Control: Manage complex role-based access control (RBAC) using Firebase custom claims and securing server-side routes.

Example Prompts

1. "Initialize Firebase auth in my new Next.js 14 project, including Google and Email/Password providers, and set up the use-auth hook."
2. "Add a middleware check that verifies Firebase ID tokens and redirects unauthenticated users to the login page."
3. "Configure a background sync route that creates a user profile in Supabase whenever a new user signs up via Firebase."

Tips & Limitations

• Planning Phase: Never bypass the Planning Protocol. Security misconfigurations are difficult to debug after production deployment.
• Credential Security: The skill is designed to interact with configuration files and SDKs. Never expose your FIREBASE_ADMIN_SERVICE_ACCOUNT in client-side code; the agent is configured to respect environment variable boundaries.
• Environment Sync: Always ensure your .env.example file is updated to reflect new providers; the agent will prompt you to verify these during the execution phase.