We already use Firebase Authentication for primary login—ID tokens on the client, verified on the backend with the Admin SDK. That answers who the user is . It does not always prove they still control the account at the moment they confirm a payment, change payout details, or export sensitive data. Step-up verification —email one-time passwords (OTP) or magic links—closes that gap.

Step-up does not replace Firebase. Users keep sending the same ID token; sensitive routes additionally require recent proof via email. Because Firebase is already in the stack, Firebase email-link sign-in was the obvious first idea.…