How to authenticate with google cloud AUTH_TOKEN with FIREBASE_TOKEN getting deprecated.

[LazyAnnoyingStupidIdiot]

Hi,

I'm currently getting an AUTH_TOKEN and shoving that into FIREBASE_TOKEN to authenticate the firebase CLI. Obviously I'm now getting:

Authenticating with `FIREBASE_TOKEN` is deprecated and will be removed in a future major version of `firebase-tools`. Instead, use a service account key with `GOOGLE_APPLICATION_CREDENTIALS`: https://cloud.google.com/docs/authentication/getting-started

I'm using gitlab and authenticating as per their documentation.
https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/

I've tried plugging the following as the GOOGLE_APPLICATION_CREDENTIALS.

PAYLOAD="$(cat <<EOF
{
  "audience": "//iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID",
  "grantType": "urn:ietf:params:oauth:grant-type:token-exchange",
  "requestedTokenType": "urn:ietf:params:oauth:token-type:access_token",
  "scope": "https://www.googleapis.com/auth/cloud-platform",
  "subjectTokenType": "urn:ietf:params:oauth:token-type:jwt",
  "subjectToken": "${GITLAB_OIDC_TOKEN}"
}
EOF
)"
echo $PAYLOAD > ./sts-creds.json
export GOOGLE_APPLICATION_CREDENTIALS=./sts-creds.json

and I get this error

[2023-08-21T01:06:46.254Z] > command requires scopes: ["email","openid","https://www.googleapis.com/auth/cloudplatformprojects.readonly","https://www.googleapis.com/auth/firebase","https://www.googleapis.com/auth/cloud-platform"]
[2023-08-21T01:06:46.266Z] Error: The incoming JSON object does not contain a private_key field
    at JWT.fromJSON (/root/.cache/firebase/tools/lib/node_modules/google-auth-library/build/src/auth/jwtclient.js:211:19)
    at GoogleAuth._cacheClientFromJSON (/root/.cache/firebase/tools/lib/node_modules/google-auth-library/build/src/auth/googleauth.js:340:20)
    at ReadStream.<anonymous> (/root/.cache/firebase/tools/lib/node_modules/google-auth-library/build/src/auth/googleauth.js:376:40)
    at ReadStream.emit (node:events:527:28)
    at ReadStream.emit (node:domain:475:12)
    at endReadableNT (node:internal/streams/readable:1345:12)
    at processTicksAndRejections (node:internal/process/task_queues:[83](https://gitlab.com/b4065/frontend/iOS/-/jobs/4908922452#L83):21)
Error: Failed to authenticate, have you run firebase login?

If anyone can let me know how to use GOOGLE_APPLICATION_CREDENTIALS with gitlab/WIF, it'd be greatly appreciated.

[LazyAnnoyingStupidIdiot]

???????????????????????????????

We are getting the message "FIREBASE_TOKEN will be deprecated" while there's no way that I'm aware of to connect the firebase CLI to authentication via OIDC.

Can we get some help / resolution to this?

[bandhanEA]

@firebase-ops do we have an estimate date for when FIREBASE_TOKEN will be depreciated?

[bandhanEA]

My firebase deployment is facing the same depreciated error as the developer above, @LazyAnnoyingStupidIdiot ! So I'm restarting this discussion on the hopes we'll get an answer @firebase-ops

[vsrikrishna]

Is there any solution for this problem?

[vipafattal]

That's weird it's still the only way mentioned in the firebase today docs without any depreciation notes