1

I have installed the package recommended by firebase for php custom tokens which can be found here, https://firebase.google.com/docs/auth/admin/create-custom-tokens found under the heading Create custom tokens using the third-party JWT library.

I have installed the php-jwt advised. I then created a service account found here and in the /apis/credentials I get similar details as below which I downloaded.

"private_key": "-----BEGIN PRIVATE KEY-----veryLongKey---END PRIVATE KEY-----\n",
"client_email": "randomemail@appspot.gserviceaccount.com",

I then generate a token using the format illustrated by the link at the top.

However when I put that $theCreatedToken in this curl .... 

    $url = 'https://localhost-42d67.firebaseio.com/Devices.json?auth=' .$theCreatedToken;
    $arr = array("success" =>array("iPhone"=>500));
    $data_string = json_encode($arr);
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "PATCH");
    curl_setopt($ch, CURLOPT_POSTFIELDS, $data_string);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Content-Type: application/json',
    'Content-Length: ' . strlen($data_string))
    );
echo $result = curl_exec($ch);

I get this error { "error": "Expected an ID token, but was given a custom token." }

If I remove the ?auth=' .$theCreatedToken; it works. What am I doing wrong? I have searched this extensively but there is no answer. I hope someone is able to help. Best

Frank van Puffelen
  • 565,676
  • 79
  • 828
  • 807
Sprep
  • 528
  • 10
  • 18

1 Answers1

0

It's pretty confusing, but I got it worked by using this library and the service accounts JSON generated in Firebase settings.

https://github.com/kreait/firebase-php

I also wrote this library to make it work with Guzzle 5 and PHP 5.6

https://github.com/luqmanrom/firebase-php

Apparently, it uses Bearer token in Authorization header instead of passing the auth token in query strings. The token is fetched from the Google OAuth2 server.

Hopefully it helps

geckob
  • 7,680
  • 5
  • 30
  • 39
  • Yes, its insanely confusing. I did the same as you in the end :) – Sprep Jan 04 '17 at 14:32
  • I have to rewrite to make it work with Guzzle 5. Will make it as public package later. Please rate if this is helpful – geckob Jan 05 '17 at 02:33