--- title: Best Practices for Anonymous Authentication | daily.dev description: Anonymous authentication in Firebase lets developers give users a frictionless onboarding experience by creating a guest account tied to a random UID, avoiding... canonical: https://daily.dev/posts/best-practices-for-anonymous-authentication-wjltgkwju twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Best Practices for Anonymous Authentication | daily.dev og:description: Anonymous authentication in Firebase lets developers give users a frictionless onboarding experience by creating a guest account tied to a random UID, avoiding... og:url: https://daily.dev/posts/best-practices-for-anonymous-authentication-wjltgkwju og:image: https://api.daily.dev/og/posts/WjltgKwJu.png og:image:alt: Best Practices for Anonymous Authentication og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Best Practices for Anonymous Authentication **[Firebase](https://daily.dev/sources/firebase-blog)** · 10 min read · 0 upvotes · 0 comments ## Summary Anonymous authentication in Firebase lets developers give users a frictionless onboarding experience by creating a guest account tied to a random UID, avoiding forced sign-up screens. The UID can be used to store user data, and later linked to a permanent credential (email/password, Google, Apple) without losing data. Best practices covered include converting users seamlessly via linkWithCredential, cleaning up stale anonymous accounts after thirty days using Identity Platform and the Delete User Data extension, restricting sensitive features via Security Rules and Cloud Functions checks on sign_in_provider, and avoiding anonymous auth as a substitute for app attestation (use App Check instead). ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I upgrade a Firebase anonymous user to a permanent account without losing their data? Link the new credential to the existing anonymous account using linkWithCredential instead of calling a signInWith method. Create the credential (for example EmailAuthProvider.credential with email and password), then call linkWithCredential(auth.currentUser, credential). The UID stays the same, so all data already associated with the anonymous user remains accessible after the upgrade. _daily.dev surfaces practical Firebase auth patterns for developers wiring up account upgrade flows._ ### How can I prevent anonymous Firebase users from accessing restricted data in Security Rules? Check the sign_in_provider token claim in Firestore Security Rules and deny access when it equals 'anonymous'. For example: allow write: if request.auth != null && request.auth.token.firebase.sign_in_provider != 'anonymous'. This blocks anonymous users from writing to protected collections while still allowing fully authenticated users through. _Developers locking down Firebase data by user type can track auth patterns like this on daily.dev._ ### Is it safe to use Firebase anonymous authentication for app attestation? No, anonymous authentication should not be used to verify that requests come from a genuine app. Anonymous user tokens can be issued through the Firebase REST API, so a malicious actor can generate one and use it to access resources gated only by an anonymous token. Firebase App Check, available for iOS, Android, and web, is the recommended tool for app attestation instead. _daily.dev helps developers stay on top of secure patterns like app attestation versus anonymous auth._ ## Similar posts on daily.dev - [Authentication made easy: Building a secure e-commerce shopping cart with Firebase](https://daily.dev/posts/authentication-made-easy-building-a-secure-e-commerce-shopping-cart-with-firebase-pnlz7lysc) · Firebase · 0 upvotes · 0 comments - [Optimize Identity Flows with Auth0 Identity Conversion Suite](https://daily.dev/posts/optimize-identity-flows-with-auth0-identity-conversion-suite-ssfljxafp) · Auth0 · 0 upvotes · 0 comments - [Authentication Provider Types: A Guide to Best Practices](https://daily.dev/posts/authentication-provider-types-a-guide-to-best-practices-ujx0dewj2) · Security Boulevard · 0 upvotes · 0 comments - [Insecure Firestore Security Rules & PII Exposure](https://daily.dev/posts/insecure-firestore-security-rules-pii-exposure-2yicfecec) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#mobile](https://daily.dev/tags/mobile), [#authentication](https://daily.dev/tags/authentication), [#firebase](https://daily.dev/tags/firebase) [View this post on daily.dev](https://daily.dev/posts/best-practices-for-anonymous-authentication-wjltgkwju) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Best Practices for Anonymous Authentication","url":"https://daily.dev/posts/best-practices-for-anonymous-authentication-wjltgkwju","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/best-practices-for-anonymous-authentication-wjltgkwju"},"datePublished":"2026-08-23T12:20:50.078Z","dateModified":"2026-08-23T12:50:55.266Z","description":"Anonymous authentication in Firebase lets developers give users a frictionless onboarding experience by creating a guest account tied to a random UID, avoiding...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7ed721de96163685d26ab7e314be3ebc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7ed721de96163685d26ab7e314be3ebc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Firebase","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Firebase","logo":"https://media.daily.dev/image/upload/s--i395oqZH--/f_auto,q_auto/v1787487448/logos/firebase-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/firebase-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/best-practices-for-anonymous-authentication-wjltgkwju","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"mobile,authentication,firebase","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Firebase","item":"https://daily.dev/sources/firebase-blog"},{"@type":"ListItem","position":3,"name":"Best Practices for Anonymous Authentication"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/best-practices-for-anonymous-authentication-wjltgkwju#faq","mainEntity":[{"@type":"Question","name":"How do I upgrade a Firebase anonymous user to a permanent account without losing their data?","acceptedAnswer":{"@type":"Answer","text":"Link the new credential to the existing anonymous account using linkWithCredential instead of calling a signInWith method. Create the credential (for example EmailAuthProvider.credential with email and password), then call linkWithCredential(auth.currentUser, credential). The UID stays the same, so all data already associated with the anonymous user remains accessible after the upgrade. daily.dev surfaces practical Firebase auth patterns for developers wiring up account upgrade flows."}},{"@type":"Question","name":"How can I prevent anonymous Firebase users from accessing restricted data in Security Rules?","acceptedAnswer":{"@type":"Answer","text":"Check the sign_in_provider token claim in Firestore Security Rules and deny access when it equals 'anonymous'. For example: allow write: if request.auth != null && request.auth.token.firebase.sign_in_provider != 'anonymous'. This blocks anonymous users from writing to protected collections while still allowing fully authenticated users through. Developers locking down Firebase data by user type can track auth patterns like this on daily.dev."}},{"@type":"Question","name":"Is it safe to use Firebase anonymous authentication for app attestation?","acceptedAnswer":{"@type":"Answer","text":"No, anonymous authentication should not be used to verify that requests come from a genuine app. Anonymous user tokens can be issued through the Firebase REST API, so a malicious actor can generate one and use it to access resources gated only by an anonymous token. Firebase App Check, available for iOS, Android, and web, is the recommended tool for app attestation instead. daily.dev helps developers stay on top of secure patterns like app attestation versus anonymous auth."}}]} ```