title: Securely setting the first custom claim on a Firebase user
body: <p>What is the standard, secure way to set the <strong>first</strong> custom claim on all Firebase users?</p>
  <p>Firebase provides some great documentation and examples for understanding and using custom claims -- e.g. <a href="https://youtu.be/3hj_r_N0qMs?t=375" rel="nofollow noreferrer">this great video example</a> -- but most examples use an existing custom claim to authorize the creation of other custom claims; and as of this post the Firebase console provides no way to set/edit/view custom claims, nor can custom claims be set via the CLI.</p>
  <p>Here are some options I am considering:</p>
  <ul>
  <li>Create a distinct admin project, which can be used by a service account to create custom claims via the Firebase Admin SDK.</li>
  <li>Use a Cloud Function to perform custom claim creation iff a certain Firebase console action is taken, e.g. creating a Firestore Document in collection inaccessible via security rules.</li>
  <li>Ignore security for the creation of the first custom claim; only add security after this is already a custom claim on a Firebase user.</li>
  </ul>
  <p><strong>Have you encountered this problem and solved it more-elegantly?</strong></p>