Migrating users from an existing app

This document shows you how to migrate users from an existing app to Identity Platform.

Before you begin

Using the Admin SDK

The Admin SDK lets you import users without exporting user data to CSV or JSON. You can import users to all of the providers Identity Platform supports, including OAuth, SAML, and OIDC.

Up to 1000 users can be imported in a single API call. The import operation is optimized for speed and does not check for duplicate fields. Importing a user that collides with an existing uid will replace the existing user. Importing a user with any other field duplicated (such as email) will result in an additional user with the same value.

The Admin SDK attempts to upload the entire list of provided users, even when a user-specific error occurs. The operation returns a result with the summary of successful and failed imports. Error details are returned per failed user import.

Importing users with HMAC hashed passwords

HMAC hashing algorithms include HMAC_MD5, HMAC_SHA1, HMAC_SHA256 and HMAC_SHA512. You'll need to provide the hash signer key.

Node.js

getAuth()
  .importUsers(
    [
      {
        uid: 'some-uid',
        email: 'user@example.com',
        // Must be provided in a byte buffer.
        passwordHash: Buffer.from('password-hash'),
        // Must be provided in a byte buffer.
        passwordSalt: Buffer.from('salt'),
      },
    ],
    {
      hash: {
        algorithm: 'HMAC_SHA256',
        // Must be provided in a byte buffer.
        key: Buffer.from('secret'),
      },
    }
  )
  .then((results) => {
    results.errors.forEach((indexedError) => {
      console.log(`Error importing user ${indexedError.index}`);
    });
  })
  .catch((error) => {
    console.log('Error importing users :', error);
  });

Java

try {
  List<ImportUserRecord> users = Collections.singletonList(ImportUserRecord.builder()
      .setUid("some-uid")
      .setEmail("user@example.com")
      .setPasswordHash("password-hash".getBytes())
      .setPasswordSalt("salt".getBytes())
      .build());
  UserImportOptions options = UserImportOptions.withHash(
      HmacSha256.builder()
          .setKey("secret".getBytes())
          .build());
  UserImportResult result = FirebaseAuth.getInstance().importUsers(users, options);
  for (ErrorInfo indexedError : result.getErrors()) {
    System.out.println("Failed to import user: " + indexedError.getReason());
  }
} catch (FirebaseAuthException e) {
  System.out.println("Error importing users: " + e.getMessage());
}

Python

users = [
    auth.ImportUserRecord(
        uid='some-uid',
        email='user@example.com',
        password_hash=b'password_hash',
        password_salt=b'salt'
    ),
]

hash_alg = auth.UserImportHash.hmac_sha256(key=b'secret')
try:
    result = auth.import_users(users, hash_alg=hash_alg)
    for err in result.errors:
        print('Failed to import user:', err.reason)
except exceptions.FirebaseError as error:
    print('Error importing users:', error)

Go

users := []*auth.UserToImport{