Firebase SSO with Google Sign-In in ASP.NET Core MVC: One-Click Authentication

Password-based login is friction. Firebase SSO removes it: a user clicks a Google button, signs in with their Google account, and the app creates or matches their ASP.NET Core Identity account automatically. This article implements the complete flow in an ASP.NET Core MVC application — the Firebase client popup, server-side token verification, and user auto-provisioning — with .NET 10.

Why Firebase SSO Instead of Raw OAuth?

Google's OAuth flow requires you to manage authorization codes, state parameters, redirect handling, and token exchange. Firebase Authentication wraps all of that: the client SDK starts the Google sign-in popup, and your server verifies a single ID token through the Firebase REST API. There is no service account to configure and no server-side OAuth redirect to maintain — which is why this integration is popular in enterprise MVC starters such as the MVC EDevKit Basic.

The Client Side: Google Sign-In Popup

Add the Firebase client SDK and configure the app with your Firebase project settings, then attach a handler to the Google button:

<script src="https://www.gstatic.com/firebasejs/10.x/firebase-app-compat.js"></script>
<script src="https://www.gstatic.com/firebasejs/10.x/firebase-auth-compat.js"></script>
<script>
  const firebaseConfig = {
    apiKey: "@@API_KEY@@",
    authDomain: "your-project.firebaseapp.com",
    projectId: "your-project"
  };
  firebase.initializeApp(firebaseConfig);

  document.getElementById("googleLogin").addEventListener("click", async () => {
    const provider = new firebase.auth.GoogleAuthProvider();
    const result = await firebase.auth().signInWithPopup(provider);
    const idToken = await result.user.getIdToken();

    const response = await fetch("/Account/FirebaseLogin", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ idToken })
    });
    if (response.ok) window.location.href = "/Home/Index";
  });
</script>

Server-Side Token Verification

Never trust the client's claim that it signed in. Your server verifies the ID token against the Firebase REST API, then extracts the verified claims (email, name, picture):

[HttpPost]
public async Task<IActionResult> FirebaseLogin([FromBody] FirebaseLoginRequest request)
{
    var verifyUrl = "https://identitytoolkit.googleapis.com/v1/accounts:lookup"
                    + "?key=" + _config["Firebase:ApiKey"];
    using var client = new HttpClient();
    var payload = new { idToken = request.IdToken };
    var response = await client.PostAsJsonAsync(verifyUrl, payload);

    if (!response.IsSuccessStatusCode)
        return Unauthorized();

    var result = await response.Content.ReadFromJsonAsync<FirebaseLookupResult>();
    var userInfo = result?.Users?.FirstOrDefault();
    if (userInfo is null) return Unauthorized();

    return await SignInFirebaseUserAsync(userInfo.Email, userInfo.DisplayName);
}

Auto-Creating the User in ASP.NET Core Identity

If the email has no Identity account yet, create one and assign the default role. Then sign the user in:

private async Task<IActionResult> SignInFirebaseUserAsync(string email, string name)
{
    var user = await _userManager.FindByEmailAsync(email);

    if (user is null)
    {
        user = new AppUser { UserName = email, Email = email, FullName = name ?? email };
        var created = await _userManager.CreateAsync(user);
        if (!created.Succeeded) return BadRequest(created.Errors);
        await _userManager.AddToRoleAsync(user, "Member");
    }

    await _signInManager.SignInAsync(user, isPersistent: true);
    return Ok();
}

Because the token was verified server-side, creating an account from the verified email is safe. The account is linked to a real, Google-verified address, so no email-confirmation step is required for SSO users.

Key Takeaways

• Firebase SSO moves Google OAuth state handling into the Firebase SDK
• The client sends an ID token; the server verifies it via the Firebase REST API
• Verified email and profile data provision the ASP.NET Core Identity account automatically
• New SSO users receive the default least-privilege role
• No service account or server-side redirect is needed

FAQ

Is Firebase SSO safe without extra verification? Yes, because the server validates the ID token signature and audience through Firebase before trusting any claim.

Can a user with an existing email account sign in with Google? Yes. The handler looks up the user by the verified email first and signs them in instead of creating a duplicate.

Do I still need password login if I have Firebase SSO? Many apps keep both: password and email as the fallback, Google one-click as the default path. Both write to the same Identity user store.

Does Firebase SSO require a Google Cloud Console service account? No. The integration uses the Firebase API key and the REST endpoint; there is no service account setup.