Migrate from Firebase Auth

1. Export from Firebase

firebase auth:export users.json --format=JSON --project your-project

Then grab your project’s password hash parameters (Firebase console → Authentication → Users → ⋮ menu): base64_signer_key, base64_salt_separator, rounds, mem_cost. Firebase uses a modified scrypt; the parameters are project-wide, the salt is per-user in the export.

2. Import

const params = {                       // project-wide, from the console dialog
  signerKey: "…", saltSeparator: "…", rounds: 8, memCost: 14,
};
const rows = exported.users.map(u => ({
  email: u.email,
  displayName: u.displayName || null,
  sourceUserId: u.localId,
  passwordHashAlgorithm: u.passwordHash ? "firebase-scrypt" : null,
  passwordHash: u.passwordHash || null,                    // base64
  passwordHashParams: u.passwordHash
    ? JSON.stringify({ ...params, salt: u.salt })          // per-user salt + project params
    : null,
}));
// POST in batches of 500 with source: "firebase" — loop as in the Clerk guide.

Gotchas

Google sign-in users dominate Firebase apps and carry over by email — same button, same account, nothing to reconfigure.
Phone-auth-only users have no email and cannot be imported (email is required). Collect an email in-app before cutover, or migrate them as new sign-ups.
Anonymous users have no identity to migrate — let them re-register.
Hashes are stored dormant with their full scrypt parameter set, so nothing is lost — but no Axowl login path reads them. See how the import works.