Cloud Run + Firebase Auth: build a proper "Sign in with Google" flow
If you’ve ever tried to secure a Cloud Run service by simply removing "allUsers," you know the pain: you don’t get a nice Login page, you just get a generic 403 Forbidden error. Not exactly a great user experience. 🛑
You can add Identity Aware Proxy (IAP) for a login screen, but then the user is forced to login before they can see anything (what am I logging in to?) - not really user-friendly, especially for new users.
In this tutorial, we are going to fix that.
I’ll show you how to implement a proper "Sign in with Google" flow for an example Python application running on Cloud Run. I use Python and Flask here, but I created the simplest possible example so you can understand the logic regardless of your framework or language of choice.
We will use Firebase Authentication to handle the frontend login and then swap that token for a secure session cookie on the backend.
What I cover:
Why IAM permissions aren't enough (and not always what you think) for a public login page.
Setting up Firebase Auth with Google Identity Platform.
Writing the Python/Flask logic to manage session cookies.
Handling the tricky IAM Service Account permissions required to talk to Firebase Auth.
⚠️ Note: This is a demo example designed to teach you the basics of the authentication flow (AuthN).
Links:
Google Cloud console: https://console.cloud.google.com
Firebase Console: https://console.firebase.google.com
Chapters:
00:00 Intro & demo
01:51 The 403 error demo
04:14 Firebase setup
05:16 Enable Google Sign-In
06:06 Authorized domains
06:27 Firebase SDK
07:14 Frontend login page
09:01 Backend session logic
11:06 Logout endpoint
11:48 Middleware protection
13:11 Deployment
13:36 Fixing build errors
14:24 Testing login
15:07 Let's add new endpoint
17:04 Service account IAM
17:51 Summary: AuthN vs AuthZ