Building Secure Firebase Functions for Shopify Hydrogen

Introduction

Hydrogen storefronts often need custom APIs for wishlist, reviews, or loyalty redemptions. Firebase HTTPS Functions provide a serverless way to extend Shopify, but without guardrails, they can become leaky, insecure, or quota-busting.

This post shows how to scaffold secure Firebase Functions that integrate cleanly with Hydrogen, Shopify APIs, and Firestore.

Why Firebase Functions?

• ⚡ Serverless → scale on demand, no infra overhead.
• 🔐 Security → JWT verification, Firebase Auth rules.
• 🌍 Speed → low-latency edge regions.
• 🔄 Integration → bridges Shopify Storefront API with Firestore.

Example: Wishlist Function

import * as functions from "firebase-functions"; import * as admin from "firebase-admin"; import * as z from "zod"; admin.initializeApp(); const db = admin.firestore(); const WishlistSchema = z.object({ customerId: z.string(), productId: z.string(), }); export const addToWishlist = functions.https.onRequest(async (req, res) => { try { const data = WishlistSchema.parse(req.body); // Verify JWT from Firebase Auth const token = await admin.auth().verifyIdToken(req.headers.authorization || ""); if (token.uid !== data.customerId) throw new Error("Unauthorized"); await db.collection("wishlists").add(data); res.json({ success: true }); } catch (err) { res.status(400).json({ error: err.message }); } });

Security Guardrails

• ✅ JWT Verification → block unauthenticated requests.
• ✅ Zod Validation → validate payloads against schema.
• ✅ CORS Control → allow only your Hydrogen domain.
• ✅ IAM Roles → limit Firestore/Storage access.
• ✅ Secrets Management → keep API keys in GCP Secret Manager.

Patterns for Hydrogen Integration

• Wishlist: Firebase Functions → Firestore.
• Reviews: API endpoint with moderation queue.
• Loyalty: Shopify orders → webhook → Firebase Function → Firestore ledger.
• Hybrid Auth: Customer Account API + Firebase Auth tokens bridged in functions.

CI/CD Guardrails

• Run ESLint + type checks before deploy.
• Test quotas with load tests (avoid 429 errors).
• Fail deploy if functions exceed size limits.
• Monitor logs in Firebase Console + alert on errors.

Case Study: Electronics Brand

• Built wishlist + reviews endpoints in Firebase.
• Guardrails: JWT auth, schema validation, error logging.
• Result: 0 auth bypasses, <200ms average response, scalable under holiday load.

Best Practices

• ✅ Keep Shopify as the source of truth (orders, products).
• ✅ Use Firebase Functions for auxiliary features.
• ✅ Always add schema validation (Zod/Yup).
• ✅ Separate environments (staging/prod).
• ✅ Automate monitoring + alerts.

Conclusion

Firebase Functions give Hydrogen storefronts the extensibility they need — but only when built securely. With JWT, Zod, CORS, and CI guardrails, developers can extend Shopify without creating vulnerabilities.

Speed without security is just fragility.