using postman to access firebase REST API

Question

I'm trying to use postman to do REST API calls to firebase. I've managed to read from firebase when my security rule is to permit all users including unauthorized ones.

but when I use this rule :

{"rules":{".read": "auth != null", ".write": "auth != null"}}

I get 'error' : 'permission denied' from postman. I did the request token for google's web oauth2.0 client and got the authorization_code token back.

I tried to use token in the URL and in the header, tried it with GET & POST request and still get denied.

please help. Thanks in advance

Answer 1

The answers above did not work for me.

What did work for me was going to

Project Settings (top left corner gear) -> Service Accounts (far right tab) -> Database Secrets (left menu) -> Scroll down, hover over the bulltets and click Show

Use this as the auth key, i.e. .../mycollection.json?auth=HERE

Answer 2

For me it worked like this:

https://your-database-url/users.json?auth=YOUR_AUTH_KEY

Where can you get this AUTH_KEY?

you get this key from your Project Settings -> Database -> Secret Key

Answer 3

Try something like this

https://your-database-url/users.json?auth=YOUR_AUTH_KEY

Respone is a JSON of your USERS node

Answer 4

I created a Postman pre-request script for helping create a Authentication: Bearer JWT. Should save a lot of copy pasting when testing APIs with Firebase Auth. https://gist.github.com/moneal/af2d988a770c3957df11e3360af62635

Copy of script at time of posting:

/**
 * This script expects the global variables 'refresh_token' and 'firebase_api_key' to be set. 'firebase_api_key' can be found
 * in the Firebase console under project settings then 'Web API Key'.
 * 'refresh_token' as to be gathered from watching the network requests to https://securetoken.googleapis.com/v1/token from 
 * your Firebase app, look for the formdata values
 * 
 * If all the data is found it makes a request to get a new token and sets a 'auth_jwt' environment variable and updates the 
 * global 'refresh_token'.
 * 
 * Requests that need authentication should have a header with a key of 'Authentication' and value of '{{auth_jwt}}'
 *
 * Currently the nested assertions silently fail, I don't know why.
 */
pm.expect(pm.globals.has('refresh_token')).to.be.true;
pm.expect(pm.globals.has('firebase_api_key')).to.be.true;

var sdk = require('postman-collection'),
  tokenRequest = new sdk.Request({
    url: 'https://securetoken.googleapis.com/v1/token',
    method: 'POST',
    body: {
      mode: 'urlencoded',
      urlencoded: [{
          type: 'text',
          key: 'key',
          value: pm.globals.get('firebase_api_key')
        },
        {
          type: 'text',
          key: 'grant_type',
          value: 'refresh_token'
        },
        {
          type: 'text',
          key: 'refresh_token',
          value: pm.globals.get('refresh_token')
        },
      ]
    }
  });

pm.sendRequest(tokenRequest, function(err, response) {

  pm.test('request for access token was ok', function() {
    pm.expect(response).to.be.ok();
  });

  const json = response.json();
  pm.expect(json).to.an('object');

  pm.test('response json has needed properties', function() {

    pm.expect(json).to.have.own.property('access_token');
    pm.expect(json).to.have.own.property('token_type');
    pm.expect(json).to.have.own.property('refresh_token');

    const accessToken = json.access_token;
    const tokenType = json.token_type;
    const refreshToken = json.refresh_token;

    pm.environment.set('auth_jwt', tokenType + ' ' + accessToken);
    pm.globals.set('refresh_token', refreshToken);

  });

});

Answer 5

Note: Adding this answer as all Options listed here is either deprecated or not working(mostly due to missing steps).

Best way to make it work with Postman is to use Google OAuth2 access tokens. The provided link described in full length but I have added quick steps.

Step 1: Download Service-Accounts.json

Step 2: Generate Access token in Java (provided link described support in other language for this)

• make sure to include this dependency:

implementation 'com.google.api-client:google-api-client:1.25.0'

OR

<dependency>
   <groupId>com.google.api-client</groupId>
   <artifactId>google-api-client</artifactId>
   <version>1.25.0</version>
 </dependency>

• Run this code to generate token(Copied from google's javadocs)

   // Load the service account key JSON file
     FileInputStream serviceAccount = new FileInputStream("path/to/serviceAccountKey.json");

     GoogleCredential scoped = GoogleCredential
     .fromStream(serviceAccount)
     .createScoped(
         Arrays.asList(
           "https://www.googleapis.com/auth/firebase.database",
           "https://www.googleapis.com/auth/userinfo.email"
         )
     );
     // Use the Google credential to generate an access token
     scoped.refreshToken();
     String token = scoped.getAccessToken();
     System.out.println(token);

Step 3: Use the token in Postman

Answer 6

It is very simple to fetch data via Postman: Here is how I did it

1 Your DB URL

https://YOUR_PROJECT_URL.firebaseio.com/YOUR_STRUCTURE/CLASS.json

2 Add API key in header as auth

auth = Value of your API_KEY

example:

Answer 7

We can use Firebase with postman for rest APIs

How we use Firebase in postman?

1. Copy your Firebase database URL
2. Paste it into your postman URL
3. Add .json at the last like shown in the image
4. Then play with your firebase database and make REST API