@Nadia Bica well done!

@Jonathan Munguia well done!

@Gerald Spica great question! It's for sure has nothing to do with being logged in. We have 2 orgs. Org A makes the callout and Org B accepts the callout. The permissions on Org B are controlled by the External Client App. That's the only thing that controls the permissions. And that's also the gateway into your org. Now to your example. You have a user in Org B and you want to make callouts to this org from Firebase. He can't just "call Salesforce". He needs to call some API (e.g. REST API in this case). Also it's not really him who is going to call your org, right? It's the code from Firebase that he'll write. So we have firebase -> Salesforce integration. To access salesforce as a user you'd need to put login and password in the browser. But since we have once code calling another code, we can't just put the credentials, since there is no browser window. So instead, we use client_id, client_secret and tokens from the External Client App. We take those secrets, put it into our Firebase code and now we can write code there that calls our Salesforce org. And at no point we need to use any specific user or passwords. Does it help? :) I am happy to explain more if you have questions!

@Gerald Spica awesome!

@Nadia Bica as a rule of thumb, in most cases it's better not to have any try-catch at all. I'd recommend not adding them. You should only add them if you have some extra reasons to add them. But in general, it's better not to.

@Nadia Bica I also left some comments

@Oleh Faryna I think I checked it and it looked good haha :D

@Oleh Faryna wrote some comments to the questions :)