--- title: Introduction to Agent Authentication and Authorization... description: A step-by-step guide to securing AI agents built with Mastra using Firebase authentication and authorization in a Next.js application. Covers four security... canonical: https://daily.dev/posts/introduction-to-agent-authentication-and-authorization-on-mastra-using-firebase-z4ekwfr4q twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introduction to Agent Authentication and Authorization on Mastra Using Firebase | daily.dev og:description: A step-by-step guide to securing AI agents built with Mastra using Firebase authentication and authorization in a Next.js application. Covers four security... og:url: https://daily.dev/posts/introduction-to-agent-authentication-and-authorization-on-mastra-using-firebase-z4ekwfr4q og:image: https://api.daily.dev/og/posts/Z4EkwFr4Q.png og:image:alt: Introduction to Agent Authentication and Authorization on Mastra Using Firebase og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introduction to Agent Authentication and Authorization on Mastra Using Firebase **[Telerik](https://daily.dev/sources/telerik)** · 16 min read · 1 upvotes · 0 comments ## Summary A step-by-step guide to securing AI agents built with Mastra using Firebase authentication and authorization in a Next.js application. Covers four security layers: frontend route protection, API route token verification, role-based authorization via Firestore, and native Mastra server protection using the MastraAuthFirebase class. Explains the difference between authentication and authorization, walks through Firebase project setup, Google sign-in configuration, service account setup, and implementing role checks stored in Firestore to control agent access. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I use MastraAuthFirebase to protect a Mastra agent's server endpoints? Pass an instance of the MastraAuthFirebase class to the auth option in the Mastra server config, and it automatically intercepts every incoming request to validate the Firebase ID token, rejecting requests with missing or invalid tokens. It reads the FIREBASE_SERVICE_ACCOUNT and FIRESTORE_DATABASE_ID environment variables automatically, so no extra configuration is needed beyond setting those in .env. _Building agent access control with Mastra and Firebase gets easier with implementation walkthroughs like this on daily.dev._ ### What is the difference between authentication and authorization for an AI agent? Authentication verifies who is making a request, typically through a sign-in flow that issues a token proving identity on later requests. Authorization checks whether that already-identified user has permission to perform the requested action, such as checking a stored role. Both matter for agents because, unlike fixed API endpoints, agents can reason and take actions like reading databases or sending emails on a user's behalf. _Developers securing agentic applications can track patterns like this on daily.dev while designing access layers._ ### How do I store and check user roles in Firestore for authorization? Create a users collection in Firestore where each document is keyed by a value such as email, with a role field set to a string like admin, user, or blocked. A getUserRole function looks up the role by Firebase UID, returning null if no document exists, while an isUserAuthorized function checks the role against an ALLOWED_ROLES array containing only admin and user, so blocked or missing roles fail the check. _Teams designing role-based access for AI agents can follow implementations like this via daily.dev._ ## Similar posts on daily.dev - [You’ve authenticated your user, but have you authorized your agent?](https://daily.dev/posts/you-ve-authenticated-your-user-but-have-you-authorized-your-agent--jwkp8woca) · LogRocket · 0 upvotes · 0 comments - [Mastra AI — The Modern Framework for Building Production-Ready AI Agents](https://daily.dev/posts/mastra-ai-the-modern-framework-for-building-production-ready-ai-agents-awxeemnud) · Faun · 1 upvotes · 0 comments - [Securing Gemini Enterprise Agent Platform Runtime](https://daily.dev/posts/securing-gemini-enterprise-agent-platform-runtime-mosxkhmbz) · Auth0 · 0 upvotes · 0 comments - [Mastra empowers web devs to build AI agents in TypeScript](https://daily.dev/posts/mastra-empowers-web-devs-to-build-ai-agents-in-typescript-riskkvspg) · The New Stack · 1 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#authentication](https://daily.dev/tags/authentication), [#nextjs](https://daily.dev/tags/nextjs), [#firebase](https://daily.dev/tags/firebase) [View this post on daily.dev](https://daily.dev/posts/introduction-to-agent-authentication-and-authorization-on-mastra-using-firebase-z4ekwfr4q) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introduction to Agent Authentication and Authorization on Mastra Using Firebase","url":"https://daily.dev/posts/introduction-to-agent-authentication-and-authorization-on-mastra-using-firebase-z4ekwfr4q","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introduction-to-agent-authentication-and-authorization-on-mastra-using-firebase-z4ekwfr4q"},"datePublished":"2026-07-13T13:38:41.991Z","dateModified":"2026-09-14T08:01:15.457Z","description":"A step-by-step guide to securing AI agents built with Mastra using Firebase authentication and authorization in a Next.js application. Covers four security...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ba9336ea093c25e087488b08409263ea?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ba9336ea093c25e087488b08409263ea?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Telerik","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Telerik","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5ee6d4bef8ac4f84886d06f5881963e7","url":"https://daily.dev/sources/telerik"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introduction-to-agent-authentication-and-authorization-on-mastra-using-firebase-z4ekwfr4q","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,authentication,nextjs,firebase","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Telerik","item":"https://daily.dev/sources/telerik"},{"@type":"ListItem","position":3,"name":"Introduction to Agent Authentication and Authorization on Mastra Using Firebase"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/introduction-to-agent-authentication-and-authorization-on-mastra-using-firebase-z4ekwfr4q#faq","mainEntity":[{"@type":"Question","name":"How do I use MastraAuthFirebase to protect a Mastra agent's server endpoints?","acceptedAnswer":{"@type":"Answer","text":"Pass an instance of the MastraAuthFirebase class to the auth option in the Mastra server config, and it automatically intercepts every incoming request to validate the Firebase ID token, rejecting requests with missing or invalid tokens. It reads the FIREBASE_SERVICE_ACCOUNT and FIRESTORE_DATABASE_ID environment variables automatically, so no extra configuration is needed beyond setting those in .env. Building agent access control with Mastra and Firebase gets easier with implementation walkthroughs like this on daily.dev."}},{"@type":"Question","name":"What is the difference between authentication and authorization for an AI agent?","acceptedAnswer":{"@type":"Answer","text":"Authentication verifies who is making a request, typically through a sign-in flow that issues a token proving identity on later requests. Authorization checks whether that already-identified user has permission to perform the requested action, such as checking a stored role. Both matter for agents because, unlike fixed API endpoints, agents can reason and take actions like reading databases or sending emails on a user's behalf. Developers securing agentic applications can track patterns like this on daily.dev while designing access layers."}},{"@type":"Question","name":"How do I store and check user roles in Firestore for authorization?","acceptedAnswer":{"@type":"Answer","text":"Create a users collection in Firestore where each document is keyed by a value such as email, with a role field set to a string like admin, user, or blocked. A getUserRole function looks up the role by Firebase UID, returning null if no document exists, while an isUserAuthorized function checks the role against an ALLOWED_ROLES array containing only admin and user, so blocked or missing roles fail the check. Teams designing role-based access for AI agents can follow implementations like this via daily.dev."}}]} ```