Firebase

Google Firebase Authentication for recruiter and admin identity.

Used for

• Email/password and Google sign-in in the web app
• ID tokens the API validates on protected SaaS routes
• Admin operations: create users, custom claims, verification links, token revoke

Auth (env vars)

API (server)

• FIREBASE_PROJECT_ID
• FIREBASE_CLIENT_EMAIL
• FIREBASE_PRIVATE_KEY

Web (client, public in bundle)

• VITE_FIREBASE_API_KEY
• VITE_FIREBASE_AUTH_DOMAIN
• VITE_FIREBASE_PROJECT_ID

If client vars are unset, Firebase is not initialized in the browser. If server vars are missing, Admin SDK calls fail at runtime.

Notes

• Custom claims (organizationId, role) are set on signup/role change but authorization reads role from the database on each request.
• Invalid or expired tokens → unauthenticated response.