firebasefirebase-adminfirebase-clifirebase-toolsfunctions-framework

Is credential necessary when running Firebase Admin with Firebase Emulator?

I'm running Firebase Admin SDK on python through functions-framework with Firebase emulator set up on different terminal and I have a question.

While this works on shell(zsh)...:

# python
import firebase_admin
from firebase_admin import auth as admin_auth, firestore as admin_firestore, credentials

app_options = {'projectId': 'dev-some-project'}
firebase_admin.initialize_app(options=app_options)
db = admin_firestore.client()


def change_order_state(request):
    return 123


# shell
FIRESTORE_EMULATOR_HOST=localhost:8080 \
FIREBASE_AUTH_EMULATOR_HOST=localhost:9099 \
GOOGLE_APPLICATION_CREDENTIALS=./path_to_credential.json \
functions_framework --target=change_order_state --port=1234

but this, without GOOGLE_APPLICATION_CREDENTIALS, doesn't work on shell:

FIRESTORE_EMULATOR_HOST=localhost:8080 \
FIREBASE_AUTH_EMULATOR_HOST=localhost:9099 \

functions_framework --target=change_order_state --port=1234

The error log says:

google.auth.exceptions.DefaultCredentialsError:
Could not automatically determine credentials.
Please set GOOGLE_APPLICATION_CREDENTIALS or 
explicitly create credentials and re-run the application.

Is it able to run Firebase Admin with Firebase emulator without setting GOOGLE_APPLICATION_CREDENTIALS? I don't see the necessity for setting credential when running it on emulator.

Or any other solutionn is okay. I saw this article and this solution is okay as long as it can be written with Python.

The reaoson why I don't want to set GOOGLE_APPLICATION_CREDENTIALS is that I dont want to distribute credential file to ALL developpers, it's too heavy for the initial development stage.

[optional] ...and if it's not possible to run without credential, what is the minimum GCP role for giving developper when runnning Firebase Admin SDK on local machine with emulator. Firebase Admin role seems too strong for me.

Thanks!

Solution

  • Yes some credentials are necessary as it looks for credentials and applies DefaultCredentials function and you got DefaultCredentialsError.

    but you can use AnonymousCredentials class

    from google.cloud import firestore
from google.auth import credentials

client = firestore.Client(credentials=credentials.AnonymousCredentials())