{
  "id": 3780004,
  "title": "Firebase Admin SDK won't run on Cloudflare Workers, so I replaced it with fetch + WebCrypto",
  "url": "https://urgent.news/2026/08/27/firebase-admin-sdk-wont-run-on-cloudflare-workers-so-i-replaced-it",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-27T17:35:27.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/t_okugawa/firebase-admin-sdk-wont-run-on-cloudflare-workers-so-i-replaced-it-with-fetch-webcrypto-3j9e"
  },
  "original_language": "en",
  "account": "I am a 17-year-old student living on a small island in Japan's Seto Inland Sea. I operate a paid membership video platform called Okugawa Lab, built with the Next.js 16 framework and deployed to Cloudflare Workers via OpenNext. This platform utilizes Firebase Authentication and Cloud Firestore.\n\nWhile working on the project, I encountered a significant challenge: the firebase-admin SDK does not run on Cloudflare Workers. This issue is not due to configuration problems; rather, it is a limitation within the SDK itself. The problem arises from the protobufjs dependency, which generates code from strings at runtime, and Cloudflare Workers outright prohibit this behavior.\n\nTo overcome this obstacle, I replaced the firebase-admin SDK with alternative methods using the fetch API and WebCrypto. My primary objectives were to verify Firebase ID tokens sent by the browser, read and write Firestore data, and delete a user's Auth account when they delete their data. Each of these tasks can be achieved through separate HTTP APIs.\n\nFor verifying ID tokens, I utilized the firebase-auth-cloudflare-workers library, which employs only web-standard APIs and has no dependencies. This library requires a KeyStorer to cache Google's public keys. In my implementation, I opted for an in-memory store scoped to the isolate, as suggested by the documentation. The MemoryKeyStorer class handles caching and retrieval of public keys. Subsequently, I used the auth.verifyIdToken() method to decode and validate the bearer token. In case of a failure to fetch Google's public keys, I differentiated between a 401 Unauthorized error (indicating an invalid token) and a 503 Service Unavailable error (signifying an issue with Google's servers).\n\nFor other tasks, such as accessing Firestore and deleting user accounts, I generated an OAuth2 access token for the service account using the WebCrypto API. The fetch function and TextEncoder were employed to construct and sign the JWT, which was then exchanged for an access token.",
  "summary": "I'm 17, I study at a technical college on a small island in Japan's Seto Inland Sea, and I run a paid membership video platform in production: Okugawa Lab . It's a Next.js 16 app deployed to Cloudflare Workers through OpenNext, with Firebase Authentication and Cloud Firestore behind it. Last week I open-sourced the whole thing ( toma-okugawa/okugawa-lab ). This post is about the single biggest…",
  "key_points": [
    "Firebase Admin SDK cannot run on Cloudflare Workers due to protobufjs dependency",
    "Implemented Firebase ID token verification and Firestore operations using fetch API and WebCrypto",
    "Used MemoryKeyStorer for caching Google's public keys in idtoken verification"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}