Your backend verifies Firebase ID tokens. You want to call it from curl or
Postman as a specific user. Firebase gives you no button for that.

The usual answers are a sign-in REST call with an email and password (only
works for password users), the Auth emulator (not your real project), or a
small Admin SDK script that creates a custom token and exchanges it. I wrote
that script one too many times, so I turned it into a desktop app.

What the flow actually is

Getting an ID token for an arbitrary user takes two steps:

  1. Sign a custom token for the user's UID with a service-account key (createCustomToken in the Admin SDK).
  2. Exchange it at accounts:signInWithCustomToken with your project's API key. Google returns a real ID token, refresh token and expiry.

Google returns a real ID token, refresh token and expiry.

The result is indistinguishable from a token a client got by signing in, so it
passes verifyIdToken on your server.

Firebase Token Toolkit

Loading apps, picking a user and generating an ID token

Firebase Token Toolkit
does those steps in one click:

  1. Browse for your service-account JSON.
  2. Click Load apps to import your project's web, Android and iOS apps and their API keys.
  3. Pick a user from the list and click Generate.

You get the ID token, a copy button, and the decoded claims underneath. Then:

curl -H "Authorization: Bearer <ID token>" https://localhost:8080/api/me

It also covers the jobs next door:

  • Custom claims: load a user's claims as JSON, edit, save, with the 1,000-byte limit checked as you type.
  • App Check: exchange a registered debug token for an App Check token for the X-Firebase-AppCheck header.
  • Restricted keys: if your API key is restricted to an Android or iOS app, Google rejects requests that don't name the app. The toolkit sends X-Android-Package + X-Android-Cert, or X-Ios-Bundle-Identifier, like the mobile SDKs do.

Things to know

  • Use a development project: a service-account key can sign in as any user.
  • It talks to real Firebase, not the Auth emulator.
  • New custom claims show up in new tokens; existing ones keep the old claims until they refresh (about an hour).

It's a native Rust app for Linux, Windows and macOS, MIT licensed, with no
telemetry. The user guide
has screenshots of every tab and a
FAQ.

If it saves you a script, a ⭐ on
GitHub helps.