I’m developing a system with a Python backend + Next.js 14 frontend, both running in a containerized setup. Initially, Next.js was not used for frontend; that is why the backend is in Python. We use Firebase for user authentication and Firestore as our database. User routing and resource access are managed by checking permissions in Firestore. Currently, the frontend accesses the backend using an API key stored in an environment variable, without any further checks.

Given that Firebase manages the authentication process, I am evaluating whether additional server-side authentication is necessary. The setup should include admin roles that can automatically provision new user credentials.

My question is about the security implications of relying solely on Firebase for authentication and whether server-side checks would add significant value. Could there be scenarios where Firebase’s capabilities might not suffice, thus necessitating custom server-side authentication logic? Will firebase be enough or I also need firebase-admin?