---
meta:
  title: "Set up ID token permissions with Firebase"
  parentTitle: "Authentication"
  description: "Learn how to setup ID token permissions with Firebase."
---

Follow the following steps to start configure your authentication endpoint and
start building your own security logic.

## Quickstart

<Steps>
  <Step>
    <StepTitle>Install the `liveblocks/node` package</StepTitle>
    <StepContent>
      Let’s first install the `@liveblocks/node` package in your
      Firebase functions project.

      ```bash
      npm install @liveblocks/node
      ```

    </StepContent>

  </Step>
  <Step>
    <StepTitle>Set up authentication endpoint</StepTitle>
    <StepContent>

      Create a new Firebase [callable function](https://firebase.google.com/docs/functions/callable)
      as shown below. This is where you will implement your security and
      define if the current user has access to a specific room.

      ```js
      const functions = require("firebase-functions");
      const { Liveblocks } = require("@liveblocks/node");

      const liveblocks = new Liveblocks({
        secret: "{{SECRET_KEY}}",
      });

      exports.auth = functions.https.onCall(async (data, context) => {
        // Get the current user from your database
        const user = __getUserFromDB__(data);

        // Identify the user and return the result
        const { status, body } = await liveblocks.identifyUser(
          {
            userId: user.id,
            groupIds, // Optional
          },
          { userInfo: user.metadata },
        );

        return JSON.parse(body);
      });
      ```
    </StepContent>

  </Step>
  <Step>
    <StepTitle>Set up the client</StepTitle>
    <StepContent>
      On the front end, you can now replace the `publicApiKey`
      option with `authEndpoint` pointing to the endpoint you
      just created.

      ```js
      import { createClient } from "@liveblocks/client";
      import firebase from "firebase";
      import "firebase/functions";

      firebase.initializeApp({
        /* Firebase config */
      });

      const auth = firebase.functions().httpsCallable("liveblocks-auth");

      // Create a Liveblocks client
      const client = createClient({
        authEndpoint: async (room) => (await auth({ room })).data,
      });
      ```

    </StepContent>

  </Step>
  <Step lastStep>
    <StepTitle>Set permission accesses to a room</StepTitle>
    <StepContent>
      A room can have `defaultAccesses`, `usersAccesses`, and `groupsAccesses` defined.
      Permissions are then checked when users try to connect to a room. For security purposes,
      [room permissions](/docs/api-reference/authentication#id-token-room-permissions) can only be set on the back-end through `@liveblocks/node` or our REST API.
      For instance, you can use [`liveblocks.createRoom`](/docs/api-reference/liveblocks-node#post-rooms)
      to create a new room with read-only public access levels while giving write access to specific groups and users.

      ```ts highlight="7-15"
      import { Liveblocks } from "@liveblocks/node";

      const liveblocks = new Liveblocks({
        secret: "{{SECRET_KEY}}",
      });

      const room = await liveblocks.createRoom("my-room-id", {
        defaultAccesses: ["*:read"],
        groupsAccesses: {
          "my-group-id": ["*:write"],
        },
        usersAccesses: {
          "my-user-id": ["*:write"],
        },
      });
      ```

      For more information, make sure to read the section on [room permissions](/docs/api-reference/authentication#id-token-room-permissions).

    </StepContent>

  </Step>
</Steps>

## More information

Both `userId` and `userInfo` can then be used in your JavaScript application as
such:

```ts
const self = room.getSelf(); // or useSelf() in React
console.log(self.id);
console.log(self.info);
```

<Figure>
  <Image
    src="/assets/id-token-auth-diagram.png"
    alt="Auth diagram"
    width={768}
    height={576}
  />
</Figure>

---

For an overview of all available documentation, see [/llms.txt](/llms.txt).