# Google-only sign-in: use a signed token

> Does your app only support Google or Microsoft sign-in through Firebase? Ondaclip signs in with a signed token: no password, no changes to your app.

Many apps only support Google or Microsoft sign-in, through Firebase Auth.
A robot can't get past the Google sign-in window, because Google blocks
automated browsers. So Ondaclip signs in another way: with **a signed token**.

A signed token requires **your infrastructure**, because the token is signed
by the filming account of your own Google Cloud project. On Ondaclip Cloud,
describe a sign-in form instead. See [where it runs](/docs/where-it-runs/).

## How it works

1. Before a shoot, Ondaclip signs a Firebase custom token for your demo
   account's uid. It signs as the shoots' service account in your Google
   Cloud project. No key or password is involved anywhere.
2. Off camera, it exchanges the token for a session, the way your app would,
   and stores the session where your app's Firebase SDK keeps it.
3. Your app opens already signed in, and the Firebase SDK keeps the session
   fresh during long shoots.

Your app doesn't change, and the Google or Microsoft window never appears.

## What you configure

In `.ondaclip/config.yaml`:

```yaml
signIn: firebaseCustomToken
firebase:
  projectId: acme-dev          # the Firebase project of the environment you film
  apiKey: AIza...              # the public web key of your app (in its Firebase config)
devGuard:
  appHostPattern: ^acme-dev\.web\.app$
  firebaseProjectPattern: ^acme-dev$
```

In the studio, under **Settings, Demo accounts**, enter the Firebase **uid**
of each demo account (`TUTO_<ACCOUNT>_UID`), not a password. You'll find it
in the Firebase console under Authentication, Users. It's stored in your
project's Secret Manager and never shown again.

## Safety

- Ondaclip only signs for a Firebase project that matches
  `devGuard.firebaseProjectPattern`. A shoot on any other project stops
  before a token is ever created.
- The signer must be a service account in that same project. Your staging or
  production project has no such account, so no token can be signed for it.
- Permission to sign is a role in your project (Service Account Token
  Creator), which the setup command grants to the shoots' service account.
  Remove it, and no token can be signed.
- Use a fictitious demo account on an environment with fictitious data.

## Ready to film

The studio checks everything before each shoot: the Firebase settings, the
guard, the signer, and a uid for each demo account. If anything is missing,
the shoot stops and tells you exactly what to fix.

## Other sign-in services

Firebase Auth is supported first. Auth0, Supabase and Cognito work on the
same idea (a token issued by your backend). Let us know if you need one of
them.

Source: https://ondaclip.com/docs/signed-token/