# Help with Authenticating Google Sign-In Securely — Only Getting User ID **URL:** \ **Category:** Questions about Thunkable X\ **Tags:** beginner\ **Created:** [January 26, 2025, 7:35pm UTC](https://community.thunkable.com/t/help-with-authenticating-google-sign-in-securely-only-getting-user-id/3511747 "2025-01-26T19:35:40Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![classlessteacher](https://avatars.discourse-cdn.com/v4/letter/c/f08c70/32.png) [@classlessteacher](https://community.thunkable.com/u/classlessteacher)\ **Post date:** [January 26, 2025, 7:35pm UTC](https://community.thunkable.com/t/help-with-authenticating-google-sign-in-securely-only-getting-user-id/3511747/1 "2025-01-26T19:35:40Z")
Hi, I’m currently maxing out my chat gpt o1 trying to ensure I’m creating a truly secure app. I have moved to here because it believes there is no secure way to use the google sign-in block. I wondered if I could hear people’s thought’s or solutions on the following (written by gpt to succinctly describe the problem): I’m building a Thunkable app that uses the **built-in Google Sign-In block**. It’s working in the sense that I get a “success” event and a **user ID** , but I’m trying to figure out how to **securely verify** that the user is truly signed in with Google. Right now, I only see the user’s **UID** (like “1234567890”) — I **don’t** get an **ID token** or **access token** from Google. From what I’ve been reading, an **ID token** is a cryptographic proof that can be verified on a backend server or in Firebase Auth. Without it, I can’t confirm that this user ID is real or hasn’t been faked. I’m new to **authentication** , **tokens** , **Firebase** security rules, and all the new terminology like _JWTs_, _private keys_, _ID tokens_, etc. Basically: - **Should** I be getting a Google **ID token** from the Thunkable sign-in block? - If not, is there a **workaround** or alternative sign-in method that **does** produce a verifiable token? - **How** do you handle this if you need to connect your Thunkable app to Firebase securely? - Any step-by-step examples or best practices would be **amazing**. I’d love any guidance or experiences from people who have navigated this. Right now I’m worried someone could just “spoof” the sign-in by guessing the user ID. I want to ensure my user data is safe. Thanks so much in advance for any help, (I haven’t gotten to the firebase sign-in but I guess it’s a similar situation unlike the apple sign-in which has the option for identity token) Jason. ---
**Author:** ![ioannis](https://sea1.discourse-cdn.com/flex015/user_avatar/community.thunkable.com/ioannis/32/146956_2.png) [@ioannis](https://community.thunkable.com/u/ioannis)\ **Post date:** [January 28, 2025, 10:35pm UTC](https://community.thunkable.com/t/help-with-authenticating-google-sign-in-securely-only-getting-user-id/3511747/2 "2025-01-28T22:35:36Z")
Hello @classlessteacher At the moment only [sign-in via email](https://docs.thunkable.com/blocks/app-features/sign-in/sign-in) creates a user on Firebase Auth. By using this sign in method you will not get any token but you can set the rules on Real-time database to allow read and write only for registered users because the app in the background stores if a user is authenticated or not. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/thunkable/original/3X/0/f/0f59f292712368bce16ff80133ae10de8a6f27e8.png) [@system](https://community.thunkable.com/u/system)\ **Post date:** [April 28, 2025, 10:35pm UTC](https://community.thunkable.com/t/help-with-authenticating-google-sign-in-securely-only-getting-user-id/3511747/3 "2025-04-28T22:35:43Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.