Firebase Realtime Database Rules 2026-10-13

Apply these rules to the hosted Firebase Realtime Database JSON rules language as documented on 2026-10-13. The service has no independently selectable rules-engine release line. This is not the Firestore or Cloud Storage Rules language.

Rulesets and instances

• Put Realtime Database rules under the JSON rules object, using .read, .write, .validate, and .indexOn at the intended paths.
• Use Realtime Database variables such as auth, data, newData, and root; do not copy rules_version, request.auth, or Firestore match blocks into this language.
• Start production instances with no client access and grant only the application's necessary paths and operations.
• Deploy the tested rules to every intended database instance. Check project aliases, database URLs, namespaces, and deployment targets before applying a rule file.
• Keep rule changes in source control with the data schema they protect, and review the effective deployed rules rather than relying on a console or local copy.
• Restrict rule deployment and database administration to trusted identities; an ordinary data writer must not be able to replace the authorization policy.

Authentication and roles

• Require auth != null before using auth.uid or token claims on a protected path.
• Bind the user or tenant selected in the path to the authenticated UID or protected membership data. Possession of a push key or database URL does not authorize access.
• Distinguish a signed-in user from an authorized owner or administrator. Anonymous Firebase Authentication also produces an authenticated