> ## Documentation Index
> Fetch the complete documentation index at: https://docs.danubeai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Firebase

> Let agents read Firestore documents, query collections and look up Firebase Authentication users

The Firebase connector reads Cloud Firestore (native mode) and Firebase Authentication with a Google service account.

## Tools

| Tool                  | What it returns                                                                                                                                                             |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Test Connection**   | The project, database and service account after signing in and listing one collection, with a warning when the account can also write                                       |
| **Get Document**      | One document by path, with its fields as plain JSON and its create and update times                                                                                         |
| **Query Collection**  | Documents of a collection or subcollection matching filters (`==`, `!=`, `<`, `<=`, `>`, `>=`, `array-contains`, `array-contains-any`, `in`, `not-in`), ordered and limited |
| **List Collections**  | Collection IDs at the root, or the subcollections under a document                                                                                                          |
| **Look Up Auth User** | One user by email, uid or phone: uid, email, whether it is verified, display name, disabled, created and last login times, sign-in providers                                |

Firestore values come back as plain JSON: integers and doubles as numbers, timestamps as ISO strings, maps and arrays as objects and lists, references as `{"reference": "users/alice"}`, geopoints as `{"latitude", "longitude"}` and bytes as base64.

## Safety

* **No write tools.** Firestore has no read-only session that the connector could turn on the way a SQL database does, so Danube simply has no code path that writes: the connector only calls the `get`, `runQuery`, `listCollectionIds` and `accounts:lookup` endpoints. The service account's roles are the second guarantee, and Test Connection warns when the account can write.
* **Auth users without secrets.** Look Up Auth User returns only the fields listed above. Password hashes, salts, tokens, MFA details and custom claims are never returned.
* **The key signs locally.** The private key signs a short-lived request that Google exchanges for a one-hour access token, cached in memory until a minute before it expires. The token endpoint is fixed to Google's, whatever the key file says.
* **Limits on every call.** 15 s timeout by default (up to 55 s with `timeout_seconds`), 500 documents (up to 5,000 with `max_rows`) and 1 MB per result. A cut result has `truncated: true`.
* **No secrets in results.** The key and tokens are removed from every error message.

## Create a read-only service account

In the Google Cloud console for the Firebase project, or with `gcloud`:

```bash theme={null}
gcloud iam service-accounts create danube-readonly --project YOUR_PROJECT
gcloud projects add-iam-policy-binding YOUR_PROJECT \
  --member serviceAccount:danube-readonly@YOUR_PROJECT.iam.gserviceaccount.com \
  --role roles/datastore.viewer
gcloud projects add-iam-policy-binding YOUR_PROJECT \
  --member serviceAccount:danube-readonly@YOUR_PROJECT.iam.gserviceaccount.com \
  --role roles/firebaseauth.viewer
gcloud iam service-accounts keys create danube-key.json \
  --iam-account danube-readonly@YOUR_PROJECT.iam.gserviceaccount.com
```

Leave out `roles/firebaseauth.viewer` if agents should not look up users. Do not use the Firebase Admin SDK service account (`firebase-adminsdk-...`): it can write everything. If your organization blocks key creation, run the [data-plane agent](/organizations/data-plane) and store the key as a reference there.

## Connect

Open **Firebase** in the dashboard's tool catalog and click **Connect**, or let the agent call `store_credential`. Paste the whole key file into **Service account key**. The project ID is read from the key; set **Project ID** only to read another project the account has access to, and **Database ID** only for a named database other than `(default)`.

<Tabs>
  <Tab title="Direct">
    Firestore and Firebase Authentication are public Google services, so the connection is direct. Nothing needs to be allowlisted.
  </Tab>

  <Tab title="Data-plane agent">
    To keep the key inside your network, run the [data-plane agent](/organizations/data-plane) and store it as a reference, for example `env://FIREBASE_SA_JSON`. The agent needs outbound HTTPS to `oauth2.googleapis.com`, `firestore.googleapis.com` and `identitytoolkit.googleapis.com`.
  </Tab>
</Tabs>

Run **Test Connection** after saving. `auth_required` means Google refused the key (deleted or disabled); `permission_denied` means the account lacks the viewer role or Firestore is not enabled for the project.

## Example prompts

* "Show me the order `orders/o_8812` and the user who placed it."
* "Find this user's failed payments in the last week, newest first."
* "Is `alice@example.com` signed up, verified and not disabled? When did she last log in?"
* "What subcollections does `users/alice` have?"