ADR-0017: Account deletion with a Firebase token does not need the app key¶

Status¶

Accepted

Date¶

2026-10-07

Context¶

ADR-0005 gates the API with the shared app key (X-API-Key), with Firebase identity layered on top. CSL-478 adds self-service deletion to the public /delete-account/ web page. The page runs in a browser, which cannot keep the app key secret: the key lives in Secrets Manager and anything rendered into public HTML is readable by anyone.

Decision Drivers¶

Must let the web page call the one deletion path, DELETE /api/account/.
Must not publish the app key or a second key in public HTML.
Should keep every other endpoint and method behind the app key.

Considered Options¶

Option A: Render the app key into the page¶

Pros: no permission change.
Cons: publishes the key, which then gates nothing.

Option B: A separate web key¶

Pros: the app key stays private.
Cons: still public in the page; extra wiring for no real protection.

Option C: Accept a Firebase ID token in place of the key, for DELETE on the account only¶

Pros: the ID token proves who the reader is, which is the real credential for deleting their account; nothing secret is published.
Cons: one exception to ADR-0005's rule that every call carries the app key.

Decision¶

We will use Option C. AccountView uses IsFirebaseBearerDelete | HasValidAPIKey: a DELETE with a valid Firebase token passes without the key. Dev-login tokens and every other method still need the key.

Consequences¶

Positive¶

The web page deletes through the same delete_user_account path as the app.
No key is exposed.

Negative¶

ADR-0005's "the app key gates the API" now has one exception, limited to this view and method.

Risks & Mitigations¶

Risk: someone with a stolen ID token deletes that account without the app. → Mitigation: the token alone already proves the identity the app would send; tokens expire within an hour.

ADR-0005: API conventions (amended by this exception).
CSL-478 — self-service account deletion on the web page.