How can I verify a Firebase idToken in PHP without signature verification errors?

I have an Expo project that uses Firebase for email/password authentication (createUserWithEmailAndPassword and signInWithEmailAndPassword). While the client side sign-in works perfectly, verifying the returned idToken on the PHP server side fails with errors such as "Signature verification failed" (using JWT PHP) and "invalid token" (using Kreait PHP Admin).

My setup:

• npm expo install firebase
• npm expo run:ios --device
• Server side is PHP

The relevant React Native code snippets are below:

JAVASCRIPTCopied
import { initializeApp } from 'firebase/app';
import { getAuth, signInWithEmailAndPassword, createUserWithEmailAndPassword, updateProfile } from 'firebase/auth';
const firebaseConfig = {
   apiKey: "AIzaxxxxxxxxxxxxxxxxxxJxk",
   authDomain: "oxxxxxxxxx.firebaseapp.com",
   projectId: "oxxx-xxxx",
   storageBucket: "oxxx-xxxx.firebasestorage.app",
   messagingSenderId: "1111111111",
   appId: "1:111111111:web:1111111111",
   measurementId: "G-5555555555"
};

export default function Index() {
  const app = initializeApp(firebaseConfig);
  const auth = getAuth(app);

  // Email/Password Authentication
  const handleEmailAuth = async () => {
       if (!email || !password) {
           Alert.alert('Error', 'Please fill in all fields');
           return;
       }

       if (!isLogin && password !== confirmPassword) {
           Alert.alert('Error', 'Passwords do not match');
           return;
       }
       if (!isLogin && !name.trim()) {
           Alert.alert('Error', 'Please enter your name');
           return;
       }

       setLoading(true);
       try {
           let userCredential;
           
           if (isLogin) {
               userCredential = await signInWithEmailAndPassword(auth, email, password);
           } else {
               userCredential = await createUserWithEmailAndPassword(auth, email, password);
           }
           // Update user profile with name
           
           await updateProfile(userCredential.user, {
               displayName: name.trim()
           }).then(() => {
               userCredential.user.reload().then(() => { userCredential.user
                   console.log('Profile reloaded - displayname: ' + JSON.stringify(userCredential.user));
               });
           }).catch((error) => {
               console.log(error);
           }); 
           //console.log("entered name:" + JSON.stringify(await userCredential.user.getIdToken(true)));

           await registerUserInBackend(auth.currentUser, "emailpwd");
           
       } catch (error: any) {
           Alert.alert('Error', error.message);
       } finally {
           setLoading(false);
       }
   };

  const registerUserInBackend = async (responsedata: any, provider: string) => {
       try {

           const user = (provider == "google" ? responsedata.user : responsedata);
           const firebaseIdToken = provider!="google" ? JSON.stringify(await user.getIdToken(true)) : null;
           ;
           const response = await fetch('https://qqqqqqqq.com/register_user.php', {
               method: 'POST',
               headers: {
                   'Content-Type': 'application/json',
               },
               body: JSON.stringify({
                   idToken: provider == "google" ? responsedata.idToken : firebaseIdToken,
                   email: user.email,
                   name: provider=="google" ? user.name : user.displayName,
                   photo_url: provider == "google" ? user.photo: "",
                   provider: provider
               })
           });

           const data = await response.json();
           if (data.success) {
               storeUserSession(user, data.uid, responsedata.idToken);
               await signIn({
                   uid: data.uid,
                   accessToken: responsedata.accessToken,
                   email: user.email,
                   displayName: user.name,
                   photoURL: user.photo
               });
               router.replace('/(tabs)/mainScreen');
               setLoading(false);
           } else {
               setLoading(false);
               throw new Error(data.error);
           }
       } catch (error) {
           console.error('Backend registration error:', error);
       }
   };

}

The PHP code for token verification is as follows:

PHPCopied
require_once '../../vendor/autoload.php';
use Google\Client as GoogleClient;
use Kreait\Firebase\Factory;
use Kreait\Firebase\Auth;
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use GuzzleHttp\Client;

public function verifyFirebaseIdToken($idToken) {
    try {
        error_log('inside verifyFirebaseIdToken'.$idToken);
        // Verify the ID token
        $verifiedIdToken = $this->auth->verifyIdToken($idToken);

        // Get user info
        return [
            'success' => true,
            'uid' => $verifiedIdToken->claims()->get('sub'),
            'email' => $verifiedIdToken->claims()->get('email'),
            'email_verified' => $verifiedIdToken->claims()->get('email_verified'),
            'name' => $verifiedIdToken->claims()->get('name')
        ];
    } catch (\Kreait\Firebase\Exception\Auth\FailedToVerifyToken $e) {
        error_log('inside catch1'.$e);
        return ['success' => false, 'error' => 'Invalid token'];
    } catch (\Exception $e) {
        error_log('inside catch2'.$e);
        return ['success' => false, 'error' => $e->getMessage()];
    }
}

public function verifyIdToken($idToken) {
    try {
        $tokenParts = explode('.', $idToken);
        if (count($tokenParts) != 3) {
            throw new Exception('Invalid token format');
        }

        // Get token header to determine which key to use
        $header = json_decode(base64_decode($tokenParts[0]), true);
        if (!isset($header['kid']) || !isset($this->publicKeys[$header['kid']])) {
            throw new Exception('Invalid token header');
        }

        $publicKey = $this->publicKeys[$header['kid']];

        error_log('verifyIdToken - idtoken:'.$idToken);
        error_log('verifyIdToken - kid:'.$header['kid']);
        error_log('verifyIdToken - publicKey:'.$publicKey);
        $decodedToken = JWT::decode($idToken, new Key($publicKey, 'RS256'));  
        error_log('verifyIdToken - decodedToken:'.$decodedToken);

        // Verify issuer and audience
        if ($decodedToken->iss !== 'https://securetoken.google.com/oxxx-00000') {
            throw new Exception('Invalid token issuer');
        }

        return [
            'success' => true,
            'uid' => $decodedToken->sub,
            'email' => $decodedToken->email ?? null,
            'email_verified' => $decodedToken->email_verified ?? false,
            'name' => $decodedToken->name ?? null
        ];

    } catch (Exception $e) {
        return ['success' => false, 'error' => $e->getMessage()];
    }
}

// in my register_user.php
error_log('token: '.$data['idToken']);
error_log('email: '.$data['email']);

if($data['provider']=='google')
    $verifyTokenResponse = $Oxxx->validateGoogleToken($data['idToken']);
else
    $verifyTokenResponse = $Oxxx->verifyFirebaseIdToken($data['idToken']);
error_log('verifyTokenResponse: '.implode($verifyTokenResponse));

Additional details:

• The Firebase console is set up for iOS, Android, and web
• The googleservices plist is added to the root directory
• I also tried using react-native-firebase/auth and /app, but ended up reinstalling firebase (npm install firebase) with the same error
• I deleted the node_modules folder and reinstalled (npm install + pod install); the error persists

What I have tried so far:

• Verified that the idToken printed on the client is the same on the server side
• Confirmed that the kid in the idToken is present in https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com
• Firebase shows the user in the "users" tab on the console
• In jwt.io, the generated idToken decodes correctly (header and payload) but always indicates an "invalid signature"
• Tried sending userCredential.user instead of auth.currentUser within handleEmailAuth(), but the error remains

Based on the discussion and answers, it appears that the issue might be related to how the token is sent from the client. In the affected code, the idToken is wrapped in JSON.stringify, which converts what should be a raw JWT string into a quoted string, resulting in an invalid token format when verifying the signature on PHP. Removing JSON.stringify to send the raw token should resolve the issue.

What am I missing? Any help would be greatly appreciated.