This repository was archived by the owner on Nov 20, 2025. It is now read-only.
Feature Request: Official support for integration with firebase-admin and google-auth-library ExternalAccountClient. #1322
Description
Is your feature request related to a problem? Please describe.
firebase-admin 
We can calculate STS response from cachedAccessToken that is calculated from above, but it is private field.
Describe the solution you'd like
Exposing cached STS response, and optionally, exposing cachedAccessToken.
Describe alternatives you've considered
Only storing cached STS response and make cachedAccessToken getter.
Additional context
Workaround:
import admin from 'firebase-admin'
import type { GoogleOAuthAccessToken } from 'firebase-admin/app'
import type { FooAccountClient, Credentials as GoogleAPICredentials } from 'google-auth-library'
// Converting to original STS response format.
const convertToFirebaseCredential = (gapiCred: GoogleAPICredentials): GoogleOAuthAccessToken => {
const { access_token, expiry_date } = gapiCred
if (typeof access_token !== 'string')
throw new Error('Google auth credential without access_token is incompatible')
if (typeof expiry_date !== 'number')
throw new Error('Google auth credential without expiry_date is incompatible')
return {
access_token,
// inverse opertation of following
// https://github.com/googleapis/google-auth-library-nodejs/blob/5ed910513451c82e2551777a3e2212964799ef8e/src/auth/baseexternalclient.ts#L446-L446
expires_in: Math.floor((expiry_date - new Date().getTime()) / 1000),
}
}
// Usage example
const createApp = async () => {
const client = new FooAccountClient({ /* ... */ });
const credential = {
getAccessToken: async () => {
await client.getAccessToken()
// cachedAccessToken is private
const gapiCred: GoogleAPICredentials = (client as any).cachedAccessToken
return convertToFirebaseCredential(gapiCred)
},
};
admin.initializeApp({
// ...
credential,
});
}It is real working workaround in our project.