title: Firebase - Verifying api requests have a valid id token in .net 5
body: <p>I'm using firebase auth from a flutter app which gets a jwt from the front end like so:</p>
  <pre><code>accessToken = await user!.getIdToken(true);
  </code></pre>
  <p>Now I want my .net 5 AspNetCore back end app to verify the id token.</p>
  <p>I add the firebase admin SDK to my .net app like so:</p>
  <p>In <code>startup.cs</code>:</p>
  <pre><code>FirebaseApp.Create();
  </code></pre>
  <p>The <a href="https://firebase.google.com/docs/auth/admin/verify-id-tokens" rel="nofollow noreferrer">Firebase docs</a> show how to verify the id token:</p>
  <pre><code>FirebaseToken decodedToken = await FirebaseAuth.DefaultInstance
      .VerifyIdTokenAsync(idToken);
  string uid = decodedToken.Uid;
  </code></pre>
  <p>But where does this code go? It's not something I want to manually do for every controller endpoint in my AspNetCore app. Can this be done as middleware to occur automatically on every api request?</p>
  <p>EDIT: Eeek I don't even think Firebase Admin is what I want. I just want to verify the jwt id token which is created on the client using Firebase Auth for Flutter, in the most firebasey way possible. It is not for admins, it is for normal users. I thought Firebase Admin was that. What direction should I take? I have found all sorts of articles online about different strategies so am confused which is the right one. Is this sufficient? <a href="https://dominique-k.medium.com/using-firebase-jwt-tokens-in-asp-net-core-net-5-834c43d4aa00" rel="nofollow noreferrer">https://dominique-k.medium.com/using-firebase-jwt-tokens-in-asp-net-core-net-5-834c43d4aa00</a> It doesn't seem very firebasey and seems quite over simplified? I think Dharmaraj's answer below is the most firebasey way, but I'm unsure where <code>idToken</code> gets a value from (how to get from the request headers? Otherwise it is just null).</p>