What you will build
Prerequisites
- A Firebase project with Authentication enabled, and the Firebase CLI
- A published to send
Use the non-blocking trigger
Firebase gives you two ways to run code when a user is created, and for a welcome message the older one is the right one.functions.auth.user().onCreate() is a 1st-gen trigger. It runs after the user exists, asynchronously, and nothing you do in it can affect the signup. There is no 2nd-gen equivalent, and Firebase says so plainly: 2nd gen does not support Authentication triggers. The two generations coexist in one file, so this is not a reason to avoid 2nd gen elsewhere.
beforeUserCreated is the 2nd-gen blocking function, and it is the wrong tool here for three reasons:
- It requires upgrading the project to Firebase Authentication with Identity Platform.
- It must respond within 7 seconds, after which Firebase returns an error and the client operation fails. A slow send would block a signup.
- Deleting the function without unregistering its trigger prevents all users from authenticating.
Set it up
1
Install the dependencies
In your functions directory:
2
Store your Courier key as a secret
Firebase keeps secrets in Cloud Secret Manager and injects them at runtime.Bind it to the function that needs it. Secret values are hidden until the function runs, so they cannot be read at deploy time.
3
Write the function
The handler receives a The
UserRecord. Its uid, email, and displayName are the three fields worth reading here.functions/index.js
runWith call is what grants access to the secret, which then arrives on process.env. Importing from firebase-functions/v1 explicitly keeps this working alongside 2nd-gen functions in the same file.4
Deploy
Verify
1
Create a user
Sign up through your app, or add one from Authentication → Users in the Firebase console.
2
Read the function log
3
Confirm the send
Open in Courier and confirm the message.
What the trigger covers
More than Auth0’s equivalent, which is worth knowing if you are comparing the two.
The custom-token gap is the one to plan around. If you mint your own tokens for an existing identity system, this trigger never runs, and the profile write belongs wherever you create that user instead.