Firebase: How to add authentication into a cli application

I'm looking to build a CLI application (most likely in C#) for Linux, Windows and Mac. The App will all access some of my API's, arleady deployed in the cloud. These API's are protected using Firebase Auth. At the moment Auth is done via my website and I support Social Sign in such as GitHub, Google etc.

Now when it comes to adding auth into a CLI app I'm completely stumped. I've been Googling this and can't find anything that walks through what you need to use. Do I need to package the Admin SKD? How to do I protect my Firebase keys (do the need to be in the CLI app)?

Can anyone point me in the right direction here please?

Many thanks in advance

For email and password authentication, you can use Firebase Auth REST API to create/login a user with provided credentials. <br>For OAuth providers such as Google and Github, you can follow OAuth 2.0 Device Authorization Flow described in RFC 8628 and then call Firebase's 'sign in with OAuth credential' to create the user in Firebase Authentication. Here's the general flow for Google Auth:

1. Request device and user code from the OAuth provider (e.g. Google)
2. Open the returned link in a browser and ask user to enter the code shown (user may have to open the browser in any other device if current one cannot open a browser e.g. in VMs)
3. Keep polling for access token till you get the token or any of the errors listed in RFC 8628 section 3.5.
4. Create/SignIn the user with Firebase using sign in with OAuth credentials REST API using the accessToken returned in previous step.

The last API will return Firebase Authentication's idToken and refreshToken that you can use to further authentication users in your backend.

Checkout OAuth 2.0 for limited input device apps for more information.

<hr />

> Do I need to package the Admin SDK?

No, the Admin SDK must be used only on server side as it has privileged access to your Firebase resources like bypassing security rules.

> How to do I protect my Firebase keys (do the need to be in the CLI app)?

The keys are meant to be public (like an identifier for your project). See https://stackoverflow.com/questions/37482366/is-it-safe-to-expose-firebase-apikey-to-the-public for more information.