firebase / firebase/firebase-tools

Firebase CLI and MCP Server both ignoring provided credentials and always falls back to system/user credentials

Open
#9,870 5 comments 7 reactions 1 assignee Claimed by @joehan View on GitHub
api: core type: feature request
Dominant language
TypeScript
Stars
4.5k
Forks
1.3k
Avg merge
1d 12h
Merged PRs (30d)
84

Description

I am trying to pass an ADC environment variable `GOOGLE_APPLICATION_CREDENTIALS` to override or provide per user access credentials for my service where I allow users to integrate their firebase account. This flag is completely being ignored when the a user is already logged in on the system (through `firebase login`). This prevents us from using the MCP server as we can't force it to use provided firebase account through `GOOGLE_APPLICATION_CREDENTIALS` env.

It always looks for `~/.config/configstore/firebase-tools.json` and uses that if exists, ignoring provided env.

This is very frustrating as a developer as this breaks our integration completely and renders it unusable. This bug report is a request to allow and respect `GOOGLE_APPLICATION_CREDENTIALS` environment variable if passed, or add a flag (e.g. `--force-adc`, or `--no-system`, or `--ignore-system` or `--ignore-user-credentials`) so that we can conditionally force it to look for other places when retrieving a credential.

This affects both the regular firebase CLI tool as well as the MCP server which internally uses firebase CLI.

### [REQUIRED] Environment info

**firebase-tools:**
```
15.5.1
```

**Platform:**

```
macOS
```

### [REQUIRED] Test case

Try passing `GOOGLE_APPLICATION_CREDENTIALS` env that points to a credentials file while having a user logged in via `firebase login` command.

```
GOOGLE_APPLICATION_CREDENTIALS= firebase projects:list
```
OR
```
GOOGLE_APPLICATION_CREDENTIALS= npx firebase-tools@latest mcp
```

### [REQUIRED] Steps to reproduce

1. Log in with a account using `firebase login` command.
2. Get credentials (ADC or service account) of a different firebase account and use it in this step.
Pass `GOOGLE_APPLICATION_CREDENTIALS` env that points to a credentials file while having a user logged in via `firebase login` command.

```
GOOGLE_APPLICATION_CREDENTIALS= firebase projects:list
```
OR
```
GOOGLE_APPLICATION_CREDENTIALS= npx firebase-tools@latest mcp
```
3. Notice that it lists projects of the logged in user, not of the user with given credentials.

### [REQUIRED] Expected behavior

I expect it to use given `GOOGLE_APPLICATION_CREDENTIALS` ideally, or have a flag to tell it to use it. e.g. `--ignore-system-credentials` or `--force-adc` or something like that.

### [REQUIRED] Actual behavior

It always uses the logged in user's account ignoring provided `GOOGLE_APPLICATION_CREDENTIALS` env. And there is no way (none that I could find) to pass a flag or something to tell it to use `GOOGLE_APPLICATION_CREDENTIALS` env, not the user's config.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.