How to integrate Firebase into Google Apps Script without using (deprecated) database secret

Question

For a while ago I was using integration of Firebase in Google Apps Script as a server side and it was working finely and still working in my old projects.

But today after creating a new Firebase project and a new realtime database then trying to integrate Firebase Project into my Google Script project I got an error and it's not working completely. And I realize that Firebase deprecated database secret for new projects.

So, my question now is how to come over this problem? Is there another way to integrate Firebase into Google Script project?

Answer 1

You'll need to add the correct OAuth scopes to the manifest file of your Apps Script project, and then pass in an access_token parameter (or in the Authorization header) instead of the auth parameter you currently use.

Based on Doug's gist here, the basic steps are:

1. Open the manifest.json from the script editor, by clicking View > Show manifest file.

2. Add or edit the manifest to have these OAuth scopes:

   "oauthScopes": [
     "https://www.googleapis.com/auth/userinfo.email",
     "https://www.googleapis.com/auth/firebase.database",
     "https://www.googleapis.com/auth/script.external_request",
     "https://www.googleapis.com/auth/spreadsheets"
   ]
   

   That last scope grants it access to the spreadsheet itself. If you're using another GSuite type (document, slides, form, etc) you'll need the scope that corresponds that to type.

3. Now you can get the OAuth token from within your script and add it to your request:

   var response = UrlFetchApp.fetch(databaseUrl, {
     method: "PUT",
     headers: {
       "Content-type": "application/json",
       "Authorization": "Bearer "+ScriptApp.getOAuthToken()
     },
     payload: JSON.stringify(json)
   });
   Logger.log(response.getContentText());
   

A major advantage of this is that your script will now run as an actual user, meaning that you can ensure it can only perform authorized actions through security rules.