Google-only sign-in: use a signed token

Many apps only support Google or Microsoft sign-in, through Firebase Auth. A robot can’t get past the Google sign-in window, because Google blocks automated browsers. So Ondaclip signs in another way: with a signed token.

A signed token requires your infrastructure, because the token is signed by the filming account of your own Google Cloud project. On Ondaclip Cloud, describe a sign-in form instead. See where it runs.

How it works

1. Before a shoot, Ondaclip signs a Firebase custom token for your demo account’s uid. It signs as the shoots’ service account in your Google Cloud project. No key or password is involved anywhere.
2. Off camera, it exchanges the token for a session, the way your app would, and stores the session where your app’s Firebase SDK keeps it.
3. Your app opens already signed in, and the Firebase SDK keeps the session fresh during long shoots.

Your app doesn’t change, and the Google or Microsoft window never appears.

What you configure

In .ondaclip/config.yaml:

signIn: firebaseCustomToken
firebase:
  projectId: acme-dev          # the Firebase project of the environment you film
  apiKey: AIza...              # the public web key of your app (in its Firebase config)
devGuard:
  appHostPattern: ^acme-dev\.web\.app$
  firebaseProjectPattern: ^acme-dev$

In the studio, under Settings, Demo accounts, enter the Firebase uid of each demo account (TUTO_<ACCOUNT>_UID), not a password. You’ll find it in the Firebase console under Authentication, Users. It’s stored in your project’s Secret Manager and never shown again.

Safety

• Ondaclip only signs for a Firebase project that matches devGuard.firebaseProjectPattern. A shoot on any other project stops before a token is ever created.
• The signer must be a service account in that same project. Your staging or production project has no such account, so no token can be signed for it.
• Permission to sign is a role in your project (Service Account Token Creator), which the setup command grants to the shoots’ service account. Remove it, and no token can be signed.
• Use a fictitious demo account on an environment with fictitious data.

Ready to film

The studio checks everything before each shoot: the Firebase settings, the guard, the signer, and a uid for each demo account. If anything is missing, the shoot stops and tells you exactly what to fix.

Other sign-in services

Firebase Auth is supported first. Auth0, Supabase and Cognito work on the same idea (a token issued by your backend). Let us know if you need one of them.