(create-custom-token uid auth)(create-custom-token uid auth options)Mint a custom token for uid — a short-lived JWT your client exchanges for
a real session via firebase's signInWithCustomToken. This is how you let
your own system decide who someone is (an SSO bridge, an internal user
table, an impersonation tool) and still hand them a genuine firebase
session.
Signed locally with the service account's private key, so it costs no api
call. options may carry :claims, which land in the resulting ID token's
custom claims, and :tenant-id.
Returns the token string, or an error map.
Mint a custom token for `uid` — a short-lived JWT your client exchanges for a real session via firebase's signInWithCustomToken. This is how you let your own system decide who someone is (an SSO bridge, an internal user table, an impersonation tool) and still hand them a genuine firebase session. Signed locally with the service account's private key, so it costs no api call. `options` may carry :claims, which land in the resulting ID token's custom claims, and :tenant-id. Returns the token string, or an error map.
(create-session-cookie id-token auth)(create-session-cookie id-token auth options)Exchange a freshly-minted ID token for a session cookie — a long-lived credential you can put in an httpOnly cookie, so a server-rendered app doesn't have to keep a refreshing ID token in reach of javascript.
:valid-duration is in seconds, between 5 minutes and 14 days, defaulting to 5 days. Verify what comes back with fire.auth/validate-session-cookie, or this namespace's validate-session-cookie to also check revocation.
Returns the cookie string, or an error map.
Exchange a freshly-minted ID token for a session cookie — a long-lived credential you can put in an httpOnly cookie, so a server-rendered app doesn't have to keep a refreshing ID token in reach of javascript. :valid-duration is in seconds, between 5 minutes and 14 days, defaulting to 5 days. Verify what comes back with fire.auth/validate-session-cookie, or this namespace's validate-session-cookie to also check revocation. Returns the cookie string, or an error map.
(create-user email password auth)(create-user email password auth options)Create a user with the given email and password, returning the new user's
record. options may carry :uid to choose the user's id rather than let
Firebase generate one, plus :display-name, :photo-url, :phone-number,
:email-verified, :disabled and :custom-claims.
Creating and then re-reading is the same two-step the Admin SDK does: the create endpoint answers with a stub, so the record you get back here is a real, complete one.
Create a user with the given email and password, returning the new user's record. `options` may carry :uid to choose the user's id rather than let Firebase generate one, plus :display-name, :photo-url, :phone-number, :email-verified, :disabled and :custom-claims. Creating and then re-reading is the same two-step the Admin SDK does: the create endpoint answers with a stub, so the record you get back here is a real, complete one.
(delete-user uid auth)(delete-user uid auth options)Delete a user by uid. Returns nil on success, matching charmander, whose delete-user returned the SDK's void.
Delete a user by uid. Returns nil on success, matching charmander, whose delete-user returned the SDK's void.
(delete-users uids auth)(delete-users uids auth options)Delete up to 1000 users in one call. Returns nil when they all went, or an error map whose :failures lists the ones that didn't and why — a batch delete can partly succeed, so this can't just be nil or an error.
Delete up to 1000 users in one call. Returns nil when they all went, or an error map whose :failures lists the ones that didn't and why — a batch delete can partly succeed, so this can't just be nil or an error.
(disable-user uid auth)(disable-user uid auth options)Disable a user. They stay in the project but can no longer sign in, and their existing sessions stop verifying via this namespace's validate-token.
Disable a user. They stay in the project but can no longer sign in, and their existing sessions stop verifying via this namespace's validate-token.
(enable-user uid auth)(enable-user uid auth options)Re-enable a disabled user.
Re-enable a disabled user.
(generate-email-verification-link email auth)(generate-email-verification-link email auth options)Generate an email verification link for an email address. options may
carry :continue-url.
Generate an email verification link for an email address. `options` may carry :continue-url.
(generate-password-reset-link email auth)(generate-password-reset-link email auth options)Generate a password reset link for an email address. options may carry
:continue-url to send the user somewhere specific once they're done.
Generate a password reset link for an email address. `options` may carry :continue-url to send the user somewhere specific once they're done.
(generate-sign-in-with-email-link email continue-url auth)(generate-sign-in-with-email-link email continue-url auth options)Generate a passwordless sign-in link. Unlike the other two, the continue-url is required — it's where the link lands, and firebase refuses the request without it.
Generate a passwordless sign-in link. Unlike the other two, the continue-url is required — it's where the link lands, and firebase refuses the request without it.
(generate-verify-and-change-email-link email new-email auth)(generate-verify-and-change-email-link email new-email auth options)Generate a link that verifies new-email and moves the account onto it in
one step, rather than changing the address first and verifying after.
Generate a link that verifies `new-email` and moves the account onto it in one step, rather than changing the address first and verifying after.
(get-user uid auth)(get-user uid auth options)Retrieve a user by uid.
Retrieve a user by uid.
(get-user-by-email email auth)(get-user-by-email email auth options)Retrieve a user by email address.
Retrieve a user by email address.
(get-user-by-phone-number phone-number auth)(get-user-by-phone-number phone-number auth options)Retrieve a user by E.164 phone number.
Retrieve a user by E.164 phone number.
(get-users identifiers auth)(get-users identifiers auth options)Look up many users in one round trip. identifiers is a map with any of
:uids, :emails and :phone-numbers. Returns a vector of the users that
exist — unlike the single lookups, identifiers that match nobody are
simply absent rather than an error.
Look up many users in one round trip. `identifiers` is a map with any of :uids, :emails and :phone-numbers. Returns a vector of the users that exist — unlike the single lookups, identifiers that match nobody are simply absent rather than an error.
(list-all-users auth)(list-all-users auth options)Every user in the project, as a lazy sequence. Pages are pulled in as you consume it, so this is safe on a project too big to hold in memory and cheap to walk only part of:
(first (list-all-users auth)) ; one request (take 10 (list-all-users auth)) ; still one request
Tune :page-size down if you expect to stop early and want smaller requests. Throws if a page fails — see page-seq for why that isn't an error map.
Every user in the project, as a lazy sequence. Pages are pulled in as you consume it, so this is safe on a project too big to hold in memory and cheap to walk only part of: (first (list-all-users auth)) ; one request (take 10 (list-all-users auth)) ; still one request Tune :page-size down if you expect to stop early and want smaller requests. Throws if a page fails — see page-seq for why that isn't an error map.
(list-user-factors uid auth)(list-user-factors uid auth options)The second factors a user has enrolled, each as {:id ... :type :totp|:phone ... :display-name ... :phone-number ... :enrolled-at ...}. Empty when they have none, which is the common case outside Identity Platform.
The second factors a user has enrolled, each as
{:id ... :type :totp|:phone ... :display-name ... :phone-number ...
:enrolled-at ...}. Empty when they have none, which is the common case
outside Identity Platform.(list-users auth)(list-users auth options)One page of users, newest api-side ordering. Returns
{:users [...] :next-page-token "..."}, where the token is nil on the last
page. options takes :page-size (default and maximum 1000) and :page-token.
One page of users, newest api-side ordering. Returns
{:users [...] :next-page-token "..."}, where the token is nil on the last
page. `options` takes :page-size (default and maximum 1000) and :page-token.(revoke-refresh-tokens uid auth)(revoke-refresh-tokens uid auth options)Revoke every refresh token the user holds, so their sessions can't be renewed. Already-issued ID tokens stay cryptographically valid until they expire — up to an hour — which is why this namespace's validate-token exists: it checks revocation, where fire.auth's cannot.
Revoke every refresh token the user holds, so their sessions can't be renewed. Already-issued ID tokens stay cryptographically valid until they expire — up to an hour — which is why this namespace's validate-token exists: it checks revocation, where fire.auth's cannot.
(search-users xform auth)(search-users xform auth options)Users matching a transducer. Composes over the lazy enumeration above, so a transducer that stops early stops the paging with it:
;; the first 5 staff, however many users the project has (into [] (search-users (comp (filter (comp :role :custom-claims)) (take 5)) auth))
;; everyone who never signed in (into [] (search-users (remove :last-login-at) auth))
Identity Toolkit has no query api, so this is a client-side scan: (take n) stops early, but a filter matching nothing walks every user in the project. Returns an eduction — reduce it, seq it, or pour it into a collection.
Users matching a transducer. Composes over the lazy enumeration above, so a
transducer that stops early stops the paging with it:
;; the first 5 staff, however many users the project has
(into [] (search-users (comp (filter (comp :role :custom-claims))
(take 5))
auth))
;; everyone who never signed in
(into [] (search-users (remove :last-login-at) auth))
Identity Toolkit has no query api, so this is a client-side scan: (take n)
stops early, but a filter matching nothing walks every user in the project.
Returns an eduction — reduce it, seq it, or pour it into a collection.(set-custom-user-claims uid claims auth)(set-custom-user-claims uid claims auth options)Attach custom claims to a user. They ride along inside every ID token that user is subsequently issued, which is what makes them worth having: a consumer can authorize off a verified token without a database round trip.
Pass nil or {} to clear them. Firebase refuses names that collide with a reserved claim, and the whole map must serialise to under 1000 bytes; both are checked here so the error says which rule was broken.
Claims only reach a token when one is minted, so a user with a live token keeps their old claims until it refreshes — call revoke-refresh-tokens too if a change needs to bite immediately.
Attach custom claims to a user. They ride along inside every ID token that
user is subsequently issued, which is what makes them worth having: a
consumer can authorize off a verified token without a database round trip.
Pass nil or {} to clear them. Firebase refuses names that collide with a
reserved claim, and the whole map must serialise to under 1000 bytes;
both are checked here so the error says which rule was broken.
Claims only reach a token when one is minted, so a user with a live token
keeps their old claims until it refreshes — call revoke-refresh-tokens
too if a change needs to bite immediately.(set-user-display-name uid display-name auth)(set-user-display-name uid display-name auth options)Set a user's display name. Pass nil to clear it.
Set a user's display name. Pass nil to clear it.
(set-user-email uid email auth)(set-user-email uid email auth options)Set a user's email address. As in charmander, this also resets email-verified to false — the new address hasn't been proven yet.
Set a user's email address. As in charmander, this also resets email-verified to false — the new address hasn't been proven yet.
(set-user-email-verified uid verified? auth)(set-user-email-verified uid verified? auth options)Mark a user's email as verified, or unverified.
Mark a user's email as verified, or unverified.
(set-user-password uid password auth)(set-user-password uid password auth options)Set a user's password.
Set a user's password.
(set-user-phone-number uid phone-number auth)(set-user-phone-number uid phone-number auth options)Set a user's phone number, which must be E.164 (a leading + and up to 15 digits). Pass nil to unlink the phone number entirely.
Set a user's phone number, which must be E.164 (a leading + and up to 15 digits). Pass nil to unlink the phone number entirely.
(set-user-photo-url uid photo-url auth)(set-user-photo-url uid photo-url auth options)Set a user's photo url, which must be absolute, scheme and all. Pass nil to clear it.
Set a user's photo url, which must be absolute, scheme and all. Pass nil to clear it.
(unenroll-all-user-factors uid auth)(unenroll-all-user-factors uid auth options)Take every second factor off a user at once.
Take every second factor off a user at once.
(unenroll-user-factor uid factor-id auth)(unenroll-user-factor uid factor-id auth options)Take one enrolled second factor off a user, by the :id from list-user-factors. This is the locked-out-staffer path, and it is worth audit logging on the way past — fire doesn't log it for you.
Take one enrolled second factor off a user, by the :id from list-user-factors. This is the locked-out-staffer path, and it is worth audit logging on the way past — fire doesn't log it for you.
(unlink-provider uid provider-id auth)(unlink-provider uid provider-id auth options)Unlink a sign-in provider from a user — "google.com", "password", "phone", and so on. The account itself survives.
Unlink a sign-in provider from a user — "google.com", "password", "phone", and so on. The account itself survives.
(update-user uid fields auth)(update-user uid fields auth options)Update any combination of a user's fields in one call, returning the full,
current record. fields is a kebab-case map understanding :email,
:password, :email-verified, :disabled, :display-name, :photo-url,
:phone-number, :custom-claims and :unlink-providers.
A key present with a nil value clears that field — (update-user uid {:display-name nil} auth) removes the display name, where leaving the key out entirely would have left it alone.
Every setter below is a thin wrapper over this.
Update any combination of a user's fields in one call, returning the full,
current record. `fields` is a kebab-case map understanding :email,
:password, :email-verified, :disabled, :display-name, :photo-url,
:phone-number, :custom-claims and :unlink-providers.
A key present with a nil value clears that field — (update-user uid
{:display-name nil} auth) removes the display name, where leaving the key
out entirely would have left it alone.
Every setter below is a thin wrapper over this.(validate-session-cookie project-id cookie auth)(validate-session-cookie project-id cookie auth options)fire.auth/validate-session-cookie with the same revocation and disabled-account checks validate-token adds.
fire.auth/validate-session-cookie with the same revocation and disabled-account checks validate-token adds.
(validate-token project-id token auth)(validate-token project-id token auth options)fire.auth/validate-token, plus the two checks that need admin credentials: that the account isn't disabled, and that its refresh tokens haven't been revoked since this token was issued. Returns the same claims map, or nil.
Signature and expiry alone can't tell you either of those — an ID token stays cryptographically valid for up to an hour after you revoke the session behind it. Use this where that hour matters, and fire.auth's cheaper, credential-free version where it doesn't.
Fails closed like everything else here: a lookup that errors is a nil, not a pass.
fire.auth/validate-token, plus the two checks that need admin credentials: that the account isn't disabled, and that its refresh tokens haven't been revoked since this token was issued. Returns the same claims map, or nil. Signature and expiry alone can't tell you either of those — an ID token stays cryptographically valid for up to an hour after you revoke the session behind it. Use this where that hour matters, and fire.auth's cheaper, credential-free version where it doesn't. Fails closed like everything else here: a lookup that errors is a nil, not a pass.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |