Firebase CLI command reference for Data Connect

TheFirebase CLI is a tool that lets you to manage and configure Firebaseproducts and services from the command line.

The CLI provides commands that can be used to perform a variety ofData Connect tasks, like creating a newData Connectproject, initializing a corresponding local working directory, setting up theData Connect emulator, listingData Connect resources,generating client SDKs and more.

Setup commands

AddData Connect to a Firebase project

firebase init

Usefirebase init to set up a new local project configuration. This workflowcreates or updatesFirebase configuration files inyour directory.

firebaseinit

Thefirebase init flow guides you through setting up a service and database,and optionally installing theData Connect emulator andconfiguring generated SDKs.

Service and database setup

If you selectdataconnect for product setup, the CLI prompts you for a newservice name and location, and whether to link an existing Cloud SQL forPostgreSQL instance or create a new instance.

If an existing instance is linked, the CLI checks for compatible settings, suchas IAM authentication and public IP addresses.

Note: Provisioning a new Cloud SQL instance during the flow can take up to 15minutes.Note: If you would like to use customer-managed encryption keys (CMEK) makesure you link an existing Cloud SQL database with CMEK.

Local Emulator Suite setup

The CLI flow offers to set up emulators, including theData Connectemulator.

Data Connect emulator commands

Start theData Connect emulator

emulators:start/exec

firebaseemulators:start/exec

Use theLocal Emulator Suite version of theData Connect emulatorin interactive mode withstart or script-driven, non-interactive mode withexec.

Export and import local PostgreSQL data

To support local prototyping and testing, and continuous integration, you canexport the data stored in a local database instance and import it betweendevelopment iterations and test runs.

Exports are stored as snapshots of your local PostgreSQL database.

Data Connect offers three approaches to export/import:

  • Automatic export/import configured in yourfirebase.json to providesnapshot backups on emulator shutdown and startup
  • Manual export/import using the CLI
  • Manual export/import using the VS Code extension interface

Automatic export and import configured in yourfirebase.json

To backup data between development sessions, specify an automatic backuplocation during thefirebase init sequence. This location is stored in yourfirebase.json in theemulators.dataconnect.dataDir field. Any data changesyou make will automatically be saved here between emulator runs, so it isuseful during local testing and exploration.

Manual export:emulators:export andemulators:start/exec --import

While theData Connect emulator is running, in a separate terminal,run thefirebase emulators:export command to save a snapshot of your data.Then, you can start the emulator from that snapshot by using the--importflag.

# Export data from local emulator from a separate terminalfirebaseemulators:export--onlydataconnect<export_directory># Import data from local directory, here using emulators:execfirebaseemulators:exec./<your-test-script>.sh--onlydataconnect--import<import_directory>
Note: An import directory you specify during manual import with the CLIemulators:start --import flag takes precedence over the default backupdirectory configured infirebase.json.Note: Manual import and export is a good way to seed tests with data in CI/CD.

Manual export/import: VS Code extension

In the VS Code extension UI, while the emulator is running, use theExport emulator data button to export data to export the current databasecontents. The default export location is theexportedData directory at theroot of your project directory.

Note: To modify this export location, before you start the emulator using theextension, click theConfigure emulator link.

You can import this data using the CLI, as described in the previous section.You can also import this data before starting the emulator through VS Code byclicking theConfigure emulator link and settingImport Path.

Schema and connector management commands

This section contains CLI reference information for commands you use to manageschemas and connectors.

Note: You can limit access to PostgreSQL databases by granting more or lesselevated roles to individual users. Behavior of the following commands mayvary depending on the role the current user has. SeeCloud SQL management commands.

For how-to use cases and recommended practices related to these commands, seetheschema and connector management guide.

Deploy schemas and connectors

deploy

firebasedeploy

This command deploys resources for Data Connect services indexed infirebase.json. Aschema migrationandconnector update are performed if necessary.

CommandDescription

firebase deploy

FlagDescription

–-only dataconnect

Deploy schemas and connectors for all Data Connect services for this project, but don't deploy other Firebase product resources.

–-only dataconnect:serviceId

Deploy schema and connectors for specified Data Connect service.

–-only dataconnect:serviceId:connectorId

Deploy a single connector for specified Data Connect service.

–-only dataconnect:serviceId:schema

Deploy the schema for the specified Data Connect service.

With the–-only flags, you can pass comma-separated values to deploy anysubset of resources you want.

firebasedeploy--onlydataconnect:service1:schema,dataconnect:service2

List Data Connect services, schemas and connectors

dataconnect:services:list

firebasedataconnect:services:list

This command prints out basic info about the services, schemas, and connectorsdeployed on a project.

Compare and migrate SQL schemas

When you runfirebase deploy, the CLI performs a SQL schemacomparison before deploying updates. You can also perform the comparisonand update directly with a set ofdataconnect:sql commands.

dataconnect:sql:diff

firebasedataconnect:sql:diff

This command compares local schema for a service with the current schema of thecorresponding Cloud SQL database. It prints out the commands that would be runto migrate the database to your new schema.

CommandDescription

firebase dataconnect:sql:diff

Flag/ParameterDescription

serviceId

Specify the service. If omitted, print the diff for all services in firebase.json.

dataconnect:sql:migrate

firebasedataconnect:sql:migrate

This command applies local schema changes to a service's Cloud SQL database.

When you set up a new localData Connect project, with the defaultdataconnect.yaml file, the behavior of thedataconnect:sql:migrate commandis to prompt you for any required changes, and then prompt for any optionalchanges, before executing the changes. You can modify this behavior to alwaysinclude or ignore optional changes by updating yourdataconnect.yamlconfiguration, as discussed inmigrate a schema in strict or compatible mode

In interactive environments, the CLI displays each migration SQL statement(and whether it is destructive) and prompts for the changes you want to apply.Passing the--force flag is equivalent to accepting all prompts.

In noninteractive environments:

  • Without--force, only non-destructive changes are made. If there aredestructive changes, the CLI aborts with no changes made.
  • With--force, all changes are made. If this includes any destructivechanges, they are printed and you are prompted whether you want to continue,unless the--force flag is provided.
CommandDescription

firebase dataconnect:sql:migrate

FlagDescription

serviceId

Migrate the database for the specified service. The serviceId is inferred if your project has only one service.

–-force

Automatically accept prompts.

As with other--only flags, you can provide multiple services separated bycommas.

Migrate a schema in strict or compatible mode

Data Connect schema migrations have two different schema validationmodes:strict andcompatible. Strict mode validation requires that thedatabase schema exactly match the application schema before the applicationschema can be deployed. Compatible mode validation requires that the databaseschema becompatible with the application schema, meaning elements in yourdatabase that are not used by your application schema are left unmodified.

These schema validation modes and best practices for schema migration arecovered in theschema and connector management guide

The validation mode is defined using theschemaValidation key in yourdataconnect.yaml file. IfschemaValidation is unspecified, the CLI appliescompatible changes and prompts you before executing any strict changes. Seetheconfiguration reference.

Manage changes to connectors

When you runfirebase deploy, the CLI initiates anupdate of the applicable connectors. The CLI analyzes changes to each connectorand issues a set of assessment messages with respect to connector changes thatmay cause unexpected behavior (messages are warning-level) or breakages (messagesare breaking-level) in previous versions of client code.

Note: The following lists are not exhaustive. Refer to the CLI output messagesfor warnings and errors applicable to your connector.
Impact assessmentScenario
Warning-level (wire compatible, may change behavior)
  • Removing a nullable field from a query without a@retired annotation.
Breaking-level (wire incompatible, may break clients)
  • Changing a nullable variable to non-null without a default value.
  • Changing the data type of a field to be something JSON-compatible (e.g.Int toFloat).
  • Changing a non-null column to nullable.
  • Removing a nullable variable without a@retired annotation.
  • Removing a non-null variable with a default value without a@retired annotation.
Breaking-level (wire incompatible,will break clients)
  • Removing an operation without a@retired annotation.
  • Removing a non-null field from a query without a@retired annotation.
  • Adding a non-null variable without a default value.
  • Changing the data type of a field to something incompatible (e.g.String toInt).
  • Removing a non-null variable without a default value and without a@retired annotation.

In interactive environments, the CLI displays each connector assessment andprompts for the changes you want to apply. Passing the--force flag isequivalent to accepting all assessments.

In non-interactive environments:

  • if only warning-level assessments (possible behavior changes) occur, allconnectors will be deployed and warnings will be logged to terminal.
  • if any breaking-level assessments occur, no connectors will be deployedand warnings will be logged to terminal. You can override with the--forceflag.

Audit authorization code

Data Connect helps you audit your authorization strategy by analyzingyour connector code when you deploy to the server usingfirebase deploy fromtheFirebase CLI. You can use this audit to help you review your codebase.

When you deploy your connectors, the CLI will output assessments for existing,modified and new operation code in your connector.

For modified and new operations, the CLI issues warnings and prompts youfor confirmation when you use certain access levels in your new operations, orwhen you modify existing operations to use those access levels.

Note: Insecure operation warnings are suppressed if you annotate the@auth directive in the operation with theinsecureReason argument.

Warnings and prompts always occur for:

  • PUBLIC

And, warnings and prompts occur on the following access levels when youdon't augment them with filters usingauth.uid:

  • USER
  • USER_ANON
  • USER_EMAIL_VERIFIED

For more information about authorization, refer to theauthorization and attestation guide.

SDK commands

Generate SDKs

dataconnect:sdk:generate

firebasedataconnect:sdk:generate

This command generates the typed SDKs declared inconnector.yaml.

Also see the guides for working withthe web SDKs,the Android SDKs andthe iOS SDKs.

CommandDescription

firebase dataconnect:sdk:generate

FlagDescription

–-watch

Keeps the process running and generates new SDKs whenever you save changes to your schema and connector GQL files.

If generation fails, errors will be printed to stdout, the generated code won't be changed, and the command will continue running.

–-only connectorId:platform

Only generate SDKs for a single platform and single connector.

With the–only flags, you can pass comma-separated values.

firebasedataconnect:sdk:generate–-onlyconnector1,connector1:kotlin

Cloud SQL management commands

Grant SQL roles for Cloud SQL

Data Connect operates on top of your own PostgreSQL instance hostedon Cloud SQL. SQL role commands help you manage permissions on your databasetables.

dataconnect:sql:setup

firebasedataconnect:sql:setup

This command configures initial, global permissions to tables in your database.

The default database provisioning and management flow assumes your projectuses a new (greenfield) database, and when you invokefirebase deploy,Data Connect will display database schema changes to be made andperforms any migrations after you approve. If this is your preferred flow,dataconnect:sql:setup prompts you to grant permissions includingsuperuserschema ownerships.

For existing (brownfield) databases, you may have your own workflow formigrating schemas and want to maintain schema ownership yourself. If thisis your preferred flow, make sure todecline at thedataconnect:sql:setupprompt for whetherData Connect should handle SQL migrations for you.As a result of declining,Data Connect will only takeread andwrite access to your database tables, but schema ownerships and migrationswill remain your responsibility.

For more discussion and use cases, seeManage services and databases.

dataconnect:sql:grant

firebasedataconnect:sql:grant

In some cases, you might want to access your database directlyto query or update the data generated by yourData Connect apps. Todo this, you will need to grant one of the roles defined in this sectionto the needed user or service account.

For details on the granted roles, seePostgreSQL user roles.

Note: In addition to setting PostgreSQL roles with theFirebase CLI, youwill need to assign the IAM roleroles/cloudsql.client. See theguide formanaging services and databases.
RoleSQL RolePermissionsUsageGrantable
readerfirebasereader_<db_name>_<schema_name>Read-only access to the database.

Can performSELECT operations on all tables within the specified schema.
Ideal for users or services requiring data retrieval but not modification.Yes
writerfirebasewriter_<db_name>_<schema_name>Read and write access to the database.

Can performSELECT,INSERT,UPDATE,DELETE, andTRUNCATE operations on all tables within the schema.
Suitable for users or services that need to modify data within the database.Yes
ownerfirebaseowner_<db_name>_<schema_name>Schema owner.

Has all privileges on all tables and sequences in the schema.
This role, in combination of the IAMroles/cloudsql.client role, grants permission to performing migration on the database.

For example, when callingfirebase dataconnect:sql:migrate.
Yes
superusercloudsqlsuperuserBuilt-in superuser role with full privileges on the database.

In addition to owner permissions, it can create schemas, drop schemas, install extensions, and perform any other administrative tasks.

Accessed in the CLI by logging in as "firebasesuperuser".
Required for installing extensions, creating the initial schema, and granting any of the grantable SQL roles to other users.

If a non-admin user needs superuser privileges, the migration will fail and prompt the user to ask the database administrator (i.e., a user withroles/cloudsql.admin) to run the privileged SQL commands.
Granted to users withroles/cloudsql.admin and can't be directly granted fromFirebase CLI
Note: These SQL roles are distinct from Cloud SQL IAM roles. IAM roles controlwho can access a database. SQL roles control which operations you can performwith such access, and which tables you can modify.
CommandDescription

firebase dataconnect:sql:grant

Flag/ParameterDescription

-R, --role role

The SQL role to grant, one of: owner, writer, or reader.

-E, --email email_address

Email for a user or service account to grant the role to.

Global options

The following global options apply to all commands:

  • --json switches CLI output to JSON for parsing by other tools.
  • --noninteractive and--interactive override, as needed, automaticdetection of non-TTY environments.

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-10 UTC.