title: Firestore Custom Tokens
body: <p>I am trying to use a custom auth token with firestore. I am using nodejs to generate the token with the following code.</p>
  
  <pre><code>const admin = require('firebase-admin');
  const serviceAccount = require('./ServiceAccountKey.json')
  
  admin.initializeApp({
    credential: admin.credential.cert(serviceAccount)
  });
  
  var uid = "some-uid";
  var claim = {
    control: true
  };
  admin.auth().createCustomToken(uid, true)
    .then(function(customToken) {
      console.log(customToken)
    })
    .catch(function(error) {
      console.log("Error creating custom token:", error);
    });
  </code></pre>
  
  <p>When I run it I get a token. I take that token and try it out using
  <a href="https://firestore.googleapis.com/v1beta1/projects/example-project-5caa9/databases/(default)/documents/users" rel="nofollow noreferrer">https://firestore.googleapis.com/v1beta1/projects/example-project-5caa9/databases/(default)/documents/users</a> with the headers</p>
  
  <p>Authorization:Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJjbGFpbXMiOnsiY29udHJvbCI6dHJ1ZX0sInVpZCI6InNvbWUtdWlkIiwiaWF0IjoxNTI4MTQ0NzY3LCJleHAiOjE1MjgxNDgzNjcsImF1ZCI6Imh0dHBzOi8vaWRlbnRpdHl0b29sa2l0Lmdvb2dsZWFwaXMuY29tL2dvb2dsZS5pZGVudGl0eS5pZGVudGl0eXRvb2xraXQudjEuSWRlbnRpdHlUb29sa2l0IiwiaXNzIjoiZmlyZWJhc2UtYWRtaW5zZGsteG9jMDRAZXhhbXBsZS1wcm9qZWN0LTVjYWE5LmlhbS5nc2VydmljZWFjY291bnQuY29tIiwic3ViIjoiZmlyZWJhc2UtYWRtaW5zZGsteG9jMDRAZXhhbXBsZS1wcm9qZWN0LTVjYWE5LmlhbS5nc2VydmljZWFjY291bnQuY29tIn0.Bjl6VY5CZKIpNyCayROWr_ZBSRmo11hiwtnx_cbbw2Ggk3J2x0Ml2OkpXhU-vAD6Q53fCZwGgXeCdxnsXw0lr55cJH3Q6J7gitzQoRnfJgUX9Dv1gbI90OWashxMmxtzPIpwgSnfBv61mkdv9ZVrF8o362mQBx_LUQzvGgVPEN9_9UNCH7peOS4KYr_YRMpCQVem0XMNh9WKlyBZuScjHpY6dZZhXqOHda0W9-MNAfvQ-D0pt-osq4ty-D_WYk6CjLNmxzvHoZeoIk1YShJM4Mpyec3lXFcCXNYG2c3_r2tskTB0LF7Fc7Bg5XuJwlrAzHrnRis6iZFCx8sqH1b-Zg</p>
  
  <p>get the following JSON.</p>
  
  <pre><code>{
      "error": {
          "code": 401,
          "message": "Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.",
          "status": "UNAUTHENTICATED"
      }
  }
  </code></pre>
  
  <p>My rules are as follow</p>
  
  <pre><code>service cloud.firestore {
    match /databases/{database}/documents {
      match /{document=**} {
        allow read, write: if request.auth.uid != null;
      }
    }
  }
  </code></pre>