Firebase Authentication

A Cloud Function your app calls right after sign-up sends the new user and their referral to Referalli; Auth triggers report deletions.

Connect

Firebase Auth can't carry custom data into a sign-up, so the template adds a callable function referalliSignup that your app calls right after a new user signs up. The callable's own ID-token check proves who the user is.

1. Create the connection: {"provider": "firebase", "programId": "prg_…"}. Keep the secret.

2. Copy the template from the dashboard (Settings → Auth platforms → Add → Firebase) into functions/src/referalli.ts and export it from your functions index.

3. firebase functions:secrets:set REFERALLI_WEBHOOK_URL and REFERALLI_SECRET, then deploy.

4. In the app, after createUserWithEmailAndPassword (or a first sign-in):

await httpsCallable(functions, 'referalliSignup')(window.aff.getReferral() ?? {});

The function posts { "event": "user.created", "user": { uid, email, emailVerified, displayName, metadata }, "referral": { … } } signed with x-referalli-signature (5-minute window). The template's onDelete trigger posts user.deleted; to mirror a ban, send user.updated with disabled: true.

Referral context

On your sign-up page, with the tracking script loaded, window.aff.getReferral() returns the visitor's referral. Put it where this provider carries it (below), under the default keys referalli_anon_id, referalli_click_id and referalli_coupon. The older referally_* spellings are still read. Referalli never links users by email: without these keys a sign-up is not attributed.

For Firebase Authentication the referral is read from: referral.referalli_*.

Check it

Each webhook delivery is answered with what Referalli did per user (attributed, partnerId, matchedVia, or the reason it wasn't); signed-protocol calls take "test": true on /signups to see the answer without storing anything. Every connector is held to the same conformance suite.