Introduction

Using Firebase with a Spring Boot REST application usually means one of two things: verifying Firebase Authentication tokens or reading and writing data through the Firebase Admin SDK. The Spring Boot side remains a normal REST API, while Firebase provides external identity, messaging, or database services that your backend can call securely.

Add the Firebase Admin SDK

In a Maven project, start by adding the Firebase Admin dependency.

1<dependency>
2  <groupId>com.google.firebase</groupId>
3  <artifactId>firebase-admin</artifactId>
4  <version>9.3.0</version>
5</dependency>

This SDK is what your Spring Boot application uses to verify tokens and communicate with Firebase services from the server side.

Initialize Firebase Once at Startup

The Admin SDK needs service account credentials and one-time initialization.

1import com.google.auth.oauth2.GoogleCredentials;
2import com.google.firebase.FirebaseApp;
3import com.google.firebase.FirebaseOptions;
4import org.springframework.context.annotation.Bean;
5import org.springframework.context.annotation.Configuration;
6
7import java.io.FileInputStream;
8import java.io.IOException;
9
10@Configuration
11public class FirebaseConfig {
12
13    @Bean
14    public FirebaseApp firebaseApp() throws IOException {
15        FileInputStream serviceAccount = new FileInputStream("firebase-service-account.json");
16
17        FirebaseOptions options = FirebaseOptions.builder()
18            .setCredentials(GoogleCredentials.fromStream(serviceAccount))
19            .build();
20
21        if (FirebaseApp.getApps().isEmpty()) {
22            return FirebaseApp.initializeApp(options);
23        }
24        return FirebaseApp.getInstance();
25    }
26}

In production, the credential file should not be committed to source control. Use a secure deployment mechanism or environment-specific secret management.

Verify Firebase ID Tokens in REST Requests

A common Spring Boot integration is receiving a Firebase ID token from a client and verifying it on the server.

1import com.google.firebase.auth.FirebaseAuth;
2import com.google.firebase.auth.FirebaseToken;
3import org.springframework.web.bind.annotation.GetMapping;
4import org.springframework.web.bind.annotation.RequestHeader;
5import org.springframework.web.bind.annotation.RestController;
6
7@RestController
8public class UserController {
9
10    @GetMapping("/me")
11    public String me(@RequestHeader("Authorization") String authorizationHeader) throws Exception {
12        String idToken = authorizationHeader.replace("Bearer ", "");
13        FirebaseToken decodedToken = FirebaseAuth.getInstance().verifyIdToken(idToken);
14        return "Authenticated user: " + decodedToken.getUid();
15    }
16}

This lets your REST API trust Firebase for authentication while still keeping authorization decisions in your own backend.

Use Firebase Services From Spring Boot

Once initialized, the Admin SDK can also interact with Firebase services such as Firestore or Cloud Messaging.

A simple Firestore example:

1import com.google.cloud.firestore.Firestore;
2import com.google.firebase.cloud.FirestoreClient;
3
4public class UserProfileService {
5
6    public void saveProfile(String userId, Object profile) throws Exception {
7        Firestore db = FirestoreClient.getFirestore();
8        db.collection("profiles").document(userId).set(profile).get();
9    }
10}

This keeps the Spring Boot application as the REST layer while Firebase acts as an external managed backend service.

Keep Authentication and Authorization Separate

Firebase token verification answers "who is this user." Your Spring Boot application still has to answer "what is this user allowed to do."

That means many real systems combine Firebase-authenticated identity with backend-side authorization rules, role checks, or ownership checks in business logic.

If you skip that distinction, you risk treating authentication as if it were the entire security model.

Be Careful With Credentials and Environment Setup

Service account JSON files are sensitive. Do not commit them. Also be explicit about environment setup so local development, CI, and production each load the correct credentials.

A common production pattern is to mount credentials securely or use cloud-native identity instead of keeping static secrets in the container image.

Common Pitfalls

• Treating Firebase Authentication as if it automatically handles all backend authorization.
• Initializing FirebaseApp multiple times.
• Committing the service account JSON file into source control.
• Verifying the token but never validating application-specific permissions.
• Mixing client-side Firebase SDK expectations with server-side Admin SDK usage.

Summary

• Use the Firebase Admin SDK in Spring Boot for server-side Firebase integration.
• Initialize Firebase once with secure credentials.
• Verify Firebase ID tokens to authenticate REST requests.
• Call Firebase services such as Firestore from ordinary Spring components.
• Keep authentication, authorization, and credential management as separate concerns.