One post tagged with "security"

We already use Firebase Authentication for primary login—ID tokens on the client, verified on the backend with the Admin SDK. That answers who the user is. It does not always prove they still control the account at the moment they confirm a payment, change payout details, or export sensitive data. Step-up verification—email one-time passwords (OTP) or magic links—closes that gap.

Step-up does not replace Firebase. Users keep sending the same ID token; sensitive routes additionally require recent proof via email. Because Firebase is already in the stack, Firebase email-link sign-in was the obvious first idea. This post compares that shortcut with a custom OTP service layered on the same auth.