How to add Firebase user authentication to a Webflow membership site

Firebase Authentication can provide browser sign-in for a Webflow members area, but because Webflow retired native User Accounts in January 2026, secure access requires an external authentication system and server-side token verification. The approach described uses a Next.js 15 application mounted at `/members` through Webflow Cloud on Cloudflare Workers, with Firebase Email/Password authentication, a server-verified Firebase ID token stored in an httpOnly cookie, and `middleware.ts` that redirects unauthenticated users before protected pages render. Setup requires a Webflow site and Cloud environment, a Firebase project with authorized domains and a test user, Node.js 22 or newer with npm, and familiarity with Next.js App Router features. The workflow configures Firebase, creates the mounted app without manually setting `basePath`, initializes Firebase on the client, verifies RS256 JWTs against Google’s JWK keys using `jose`, creates and refreshes server cookies through a session Route Handler, and synchronizes refreshed Firebase tokens through an `onIdTokenChanged` listener. It emphasizes pinning supported Next.js 15 versions because newer releases change middleware behavior and older versions contain a middleware authorization bypass, while also warning against adding the incompatible Next.js Edge runtime directive. Common failures include missing authorized domains for OAuth providers, deployment errors caused by runtime directives, API requests that omit the `/members` mount path, and expired cookies caused by missing session synchronization. The implementation authenticates identity but does not by itself provide roles, subscription checks, token revocation checks, rate limiting, CSRF protections, origin validation, or a complete logout process, leaving those controls to later development.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.