In the past, I have used firebase.auth in the web client and once a user creates another user, I link certain security logic:
The is a workaround provided here https://github.com/firebase/firebase-admin-node/issues/46
I found a work-around that works well enough for my use case, see below. I'm not sure if this is best practice, but I wanted to keep the emails exactly the same between the server and client requests. Would love to hear about any flaws with this implementation