title: Flutter Firebase Auth - Token verification problem in PHP server
body: <p>I am using Firebase authentication in my Flutter app to manage the users (Facebook, Google, Email...). When the user log in my app, I send the Firebase token to my PHP server, where that token is verified with JWT.</p>
  <p>The problem is that, although the token generated by the email login is correctly verified, the token generated by the Facebook or Google login fails with &quot;SignatureInvalidException: Signature verification failed&quot;.</p>
  <p>Facebook login code in the Flutter app:</p>
  <pre><code>FirebaseAuth auth = FirebaseAuth.instance;
  final LoginResult result = await FacebookAuth.instance.login();
  
  final FacebookAuthCredential facebookAuthCredential = FacebookAuthProvider.credential(result.accessToken.token);
  UserCredential user = await auth.signInWithCredential(facebookAuthCredential);
  
  String token = await auth.currentUser.getIdToken();
  print(token.toString());
  
  </code></pre>
  <p>The information of the token is correctly validated in the <a href="https://jwt.io/" rel="nofollow noreferrer">https://jwt.io/</a> debugger, so the header and the payload are fine.</p>
  <p>In the PHP server (Same code for both cases):</p>
  <ul>
  <li><p>Validating the email&amp;password token (OK):</p>
  <p><em>stdClass Object ( [iss] =&gt; <a href="https://securetoken.google.com/project-123546" rel="nofollow noreferrer">https://securetoken.google.com/project-123546</a> [aud] =&gt; project-123546 [auth_time] =&gt; 1603424825 [user_id] =&gt; S2gpfdsa156dsacdsfQ2z1 [sub] =&gt; S2gpfdsa156dsacdsfQ2z1 [iat] =&gt; 1603424825 [exp] =&gt; 1603428425 [email] =&gt; user@example.com [email_verified] =&gt; [firebase] =&gt; stdClass Object ( [identities] =&gt; stdClass Object ( [email] =&gt; Array ( [0] =&gt; user@example.com ) ) [sign_in_provider] =&gt; password ) )</em></p>
  </li>
  <li><p>Validating the Facebook token (KO):</p>
  <p><em>Fatal error: Uncaught Firebase\JWT\SignatureInvalidException: Signature verification failed in server\vendor\firebase\php-jwt\src\JWT.php:122 Stack trace: #0 server\token.php(18): Firebase\JWT\JWT::decode('eygswbdsasdJSUzI...', '-----BEGIN CERT...', Array) #1 {main} thrown in server\vendor\firebase\php-jwt\src\JWT.php on line 122</em></p>
  </li>
  </ul>
  <p>PHP code:</p>
  <pre><code>$token = &quot;...TOKEN-FROM-APP...&quot;;
  $pkeys_raw = file_get_contents('https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com');
  $pkeys = json_decode($pkeys_raw, true);
  $decoded = JWT::decode($token, $pkeys, [&quot;RS256&quot;]);
  print_r($decoded);
  </code></pre>
  <p>The KeyID match with the key in <a href="https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com" rel="nofollow noreferrer">https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com</a>, but I think that the app (or Firebase) is not signing correctly the token with the private key in the Facebook and Google login. However, I am using <code>auth.currentUser.getIdToken()</code> too in the email&amp;password login, so there are not differences.</p>
  <p>Any idea how to resolve this?</p>