How to fix auth/id-token-revoked: Firebase ID token has been invalidated in Firebase

// Node.js Admin SDK example
const admin = require('firebase-admin');

try {
  const decodedToken = await admin.auth().verifyIdToken(
    idToken,
    true // checkRevoked = true
  );
  console.log('Token valid for user:', decodedToken.uid);
} catch (error) {
  if (error.code === 'auth/id-token-revoked') {
    console.log('ID token has been revoked');
    // Handle revoked token
  }
}

# Python Admin SDK example
from firebase_admin import auth

try:
    decoded_token = auth.verify_id_token(id_token, check_revoked=True)
    print('Token valid for user:', decoded_token['uid'])
except auth.RevokedIdTokenError:
    print('ID token has been revoked')
    # Handle revoked token

// JavaScript/Web SDK
import { getAuth } from 'firebase/auth';

const auth = getAuth();
const user = auth.currentUser;

if (user) {
  try {
    // Force token refresh
    const newIdToken = await user.getIdToken(true); // true = force refresh
    console.log('New token obtained:', newIdToken);

    // Retry your API request with the new token
    const response = await fetch('/api/protected', {
      headers: {
        'Authorization': `Bearer ${newIdToken}`
      }
    });
  } catch (error) {
    if (error.code === 'auth/user-token-expired') {
      // Token can't be refreshed - requires re-authentication
      console.log('Refresh token also revoked, need to re-authenticate');
    }
  }
}

// iOS Swift
Auth.auth().currentUser?.getIDTokenForcingRefresh(true) { idToken, error in
    if let error = error {
        print("Failed to refresh token:", error.localizedDescription)
        // Requires re-authentication
        return
    }

    if let idToken = idToken {
        print("New token obtained:", idToken)
        // Use new token for API requests
    }
}

// JavaScript/Web SDK
import { getAuth, signOut } from 'firebase/auth';

async function handleRevokedToken() {
  const auth = getAuth();

  try {
    // Attempt to refresh token
    const newToken = await auth.currentUser.getIdToken(true);
    return newToken;
  } catch (error) {
    // If refresh fails, sign out and redirect to login
    await signOut(auth);

    // Clear any local storage
    localStorage.removeItem('userSession');

    // Redirect to login with message
    window.location.href = '/login?reason=token_revoked';
  }
}

// Server-side response (Express)
app.use(async (req, res, next) => {
  try {
    const idToken = req.headers.authorization?.split('Bearer ')[1];
    const decodedToken = await admin.auth().verifyIdToken(idToken, true);
    req.user = decodedToken;
    next();
  } catch (error) {
    if (error.code === 'auth/id-token-revoked') {
      return res.status(401).json({
        error: 'TOKEN_REVOKED',
        message: 'Your session has been revoked. Please sign in again.',
        requiresReauth: true
      });
    }
    next(error);
  }
});

// React example with automatic retry
import { useEffect, useState } from 'react';
import { getAuth, onAuthStateChanged } from 'firebase/auth';

function useAuthToken() {
  const [token, setToken] = useState(null);
  const [error, setError] = useState(null);
  const auth = getAuth();

  useEffect(() => {
    const unsubscribe = onAuthStateChanged(auth, async (user) => {
      if (user) {
        try {
          const idToken = await user.getIdToken(true);
          setToken(idToken);
        } catch (err) {
          setError(err);
          // Redirect to login if token can't be obtained
          window.location.href = '/login?session_expired=true';
        }
      } else {
        setToken(null);
      }
    });

    return () => unsubscribe();
  }, [auth]);

  return { token, error };
}

// API interceptor example (Axios)
import axios from 'axios';
import { getAuth } from 'firebase/auth';

axios.interceptors.response.use(
  (response) => response,
  async (error) => {
    if (error.response?.status === 401 &&
        error.response?.data?.error === 'TOKEN_REVOKED') {

      const auth = getAuth();
      const user = auth.currentUser;

      if (user) {
        try {
          // Try to get new token
          const newToken = await user.getIdToken(true);

          // Retry original request with new token
          error.config.headers.Authorization = `Bearer ${newToken}`;
          return axios.request(error.config);
        } catch (refreshError) {
          // Refresh failed, redirect to login
          await auth.signOut();
          window.location.href = '/login';
        }
      }
    }
    return Promise.reject(error);
  }
);

// Without revocation check (faster, less secure)
const decodedToken = await admin.auth().verifyIdToken(idToken);

// With revocation check (slower, more secure)
const decodedToken = await admin.auth().verifyIdToken(idToken, true);

// Hybrid approach based on operation type
async function verifyToken(idToken, operationType) {
  const checkRevoked = [
    'payment',
    'settings_change',
    'admin_action',
    'delete_account'
  ].includes(operationType);

  return await admin.auth().verifyIdToken(idToken, checkRevoked);
}