Use a dedicated Nova IAM administrator account. Credentials are sent directly to Google Firebase; session tokens remain in this browser tab only.