Skip to main content
The Firebase connector reads Cloud Firestore (native mode) and Firebase Authentication with a Google service account.

​
Tools

Firestore values come back as plain JSON: integers and doubles as numbers, timestamps as ISO strings, maps and arrays as objects and lists, references as {"reference": "users/alice"}, geopoints as {"latitude", "longitude"} and bytes as base64.

​
Safety

  • No write tools. Firestore has no read-only session that the connector could turn on the way a SQL database does, so Danube simply has no code path that writes: the connector only calls the get, runQuery, listCollectionIds and accounts:lookup endpoints. The service account’s roles are the second guarantee, and Test Connection warns when the account can write.
  • Auth users without secrets. Look Up Auth User returns only the fields listed above. Password hashes, salts, tokens, MFA details and custom claims are never returned.
  • The key signs locally. The private key signs a short-lived request that Google exchanges for a one-hour access token, cached in memory until a minute before it expires. The token endpoint is fixed to Google’s, whatever the key file says.
  • Limits on every call. 15 s timeout by default (up to 55 s with timeout_seconds), 500 documents (up to 5,000 with max_rows) and 1 MB per result. A cut result has truncated: true.
  • No secrets in results. The key and tokens are removed from every error message.

​
Create a read-only service account

In the Google Cloud console for the Firebase project, or with gcloud:
Leave out roles/firebaseauth.viewer if agents should not look up users. Do not use the Firebase Admin SDK service account (firebase-adminsdk-...): it can write everything. If your organization blocks key creation, run the data-plane agent and store the key as a reference there.

​
Connect

Open Firebase in the dashboard’s tool catalog and click Connect, or let the agent call store_credential. Paste the whole key file into Service account key. The project ID is read from the key; set Project ID only to read another project the account has access to, and Database ID only for a named database other than (default).
Firestore and Firebase Authentication are public Google services, so the connection is direct. Nothing needs to be allowlisted.
Run Test Connection after saving. auth_required means Google refused the key (deleted or disabled); permission_denied means the account lacks the viewer role or Firestore is not enabled for the project.

​
Example prompts

  • “Show me the order orders/o_8812 and the user who placed it.”
  • “Find this user’s failed payments in the last week, newest first.”
  • “Is alice@example.com signed up, verified and not disabled? When did she last log in?”
  • “What subcollections does users/alice have?”