Firebase Authentication Basics

Firebase Authentication handles the process of verifying who your users are. It manages user registration, login, session handling, and password resets — tasks that take weeks to build securely from scratch. Firebase compresses that work into a few function calls.

Authentication as a Nightclub Bouncer

Think of your app as a nightclub. Not everyone gets in. The bouncer stands at the door, checks IDs, and decides who enters. Firebase Authentication is your bouncer. It checks whether the person claiming to be "alice@example.com" actually is Alice, then issues a wristband (a token) that lets Alice move through the club without showing her ID at every room.

User tries to log in
       |
       v
[ Firebase Auth ]
  Checks credentials
       |
       v
  Valid? YES -----> Issues ID Token (wristband)
  Valid? NO  -----> Returns error

What Firebase Authentication Provides

Firebase Authentication gives you these capabilities out of the box:

• Email and password registration and login
• Social login (Google, Facebook, Twitter, GitHub, Apple)
• Phone number login with SMS verification
• Anonymous sign-in for guest users
• Password reset emails
• Email verification
• Account linking (connect multiple login methods to one account)

Enabling Authentication in the Console

Firebase Authentication is not active by default. Open the Firebase Console, click Authentication in the left sidebar, then click Get started. The console shows a list of sign-in providers. Each provider requires you to click it and toggle it on before your app can use it.

For basic email and password login, click Email/Password, toggle Enable on, and click Save. The provider is now active for your project.

The User Object

When a user logs in successfully, Firebase gives your app a User object. This object contains information about the logged-in user:

User Object:
{
  uid: "abc123xyz",           // unique ID for this user
  email: "alice@example.com", // their email address
  displayName: "Alice",       // their name (if set)
  photoURL: "https://...",    // profile photo URL (if set)
  emailVerified: true,        // whether email is confirmed
  providerData: [...]         // login methods linked to account
}

The uid (user ID) is the most important field. It is a unique string that never changes for this user, even if they change their email or name. You use the UID to identify users in your database.

Setting Up Firebase Auth in Code

Import and initialize the Auth service in your project's Firebase setup file:

import { initializeApp } from "firebase/app";
import { getAuth } from "firebase/auth";

const firebaseConfig = { /* your config here */ };
const app = initializeApp(firebaseConfig);

export const auth = getAuth(app);

Now import auth anywhere in your app that needs authentication functionality.

Creating a User Account

To register a new user with an email and password:

import { createUserWithEmailAndPassword } from "firebase/auth";
import { auth } from "./firebase";

async function registerUser(email, password) {
  try {
    const userCredential = await createUserWithEmailAndPassword(
      auth,
      email,
      password
    );
    console.log("Registered:", userCredential.user.uid);
  } catch (error) {
    console.error("Error:", error.message);
  }
}

Firebase creates the account, stores the credentials securely (it hashes passwords — you never store raw passwords), and returns a userCredential object containing the User object.

Logging In an Existing User

import { signInWithEmailAndPassword } from "firebase/auth";
import { auth } from "./firebase";

async function loginUser(email, password) {
  try {
    const userCredential = await signInWithEmailAndPassword(
      auth,
      email,
      password
    );
    console.log("Logged in:", userCredential.user.email);
  } catch (error) {
    console.error("Login failed:", error.message);
  }
}

Logging Out

import { signOut } from "firebase/auth";
import { auth } from "./firebase";

async function logoutUser() {
  await signOut(auth);
  console.log("User signed out");
}

Checking the Current User

Firebase keeps track of the logged-in user automatically. You can check who is currently logged in at any point:

import { auth } from "./firebase";

// Check once
const currentUser = auth.currentUser;
if (currentUser) {
  console.log("Logged in as:", currentUser.email);
} else {
  console.log("No user logged in");
}

Note that auth.currentUser may be null briefly when the page first loads because Firebase needs a moment to restore the session from storage. The next topic covers the proper way to watch for auth state changes.

Common Error Codes

Firebase Authentication returns specific error codes that help you show helpful messages to users:

• auth/email-already-in-use — someone already registered with this email
• auth/invalid-email — the email format is incorrect
• auth/weak-password — the password is shorter than six characters
• auth/user-not-found — no account exists with this email
• auth/wrong-password — the password is incorrect

Always catch errors and map these codes to user-friendly messages. Avoid showing raw error messages directly to users.

The Users Tab in Console

Every registered user appears in the Firebase Console under Authentication > Users. The table shows each user's email, provider (email/password, Google, etc.), creation date, and UID. You can manually disable or delete accounts from this table — useful during development or when handling abuse reports.

Key Takeaway

Firebase Authentication removes the complexity of building a secure login system. Enable providers in the console, initialize the Auth service in your code, and use built-in functions to register, log in, and log out users. The User object gives you a stable UID to identify each user across your entire app. Handle error codes to show clear messages when login or registration fails.