I currently have an iframe which i embeed in my site, in a chrome extension and in 3rd party sites.

The problem is the following: I'm populating parts of my iframe with firebase data. In my site, i embeed my own iframe and is protected by a firebase token (the views), i don't know exactly how it works, but it returns the data correctly when calling the DB. Example:

 getData(
    reference: string,
  ){
    const ref = `accounts/${reference}`;
    const dataReturn = this.db.object(ref).valueChanges();
    return dataReturn;
  }

This returns just fine on my webapp, when the user logouts in my webapp, then the data is protected (as it has to be)

The problem begins here: When a 3rd party embeeds my iframe, they use an oAuth token (to get users, etc from my API), so they're not logged in my website, hence, when they embeed and try to get the data (automatically, since we call firebase onInit), they get blocked by firebase because they don't have a valid token/they're not authenticated in my website.

Is there a way to use that oAuth token to let them get the firebase data?

Same escenario happens in the chrome extension, we make the user log-in using an oAuth token (to prevent making an account and logging in in our webapp, preventing CORS issues).

These are my rules in realtime database firebase:

"accounts": {
            ".read": "auth !== null",
            ".write": false,
    }

Thank you!