Restricting Firebase security to a specific Google Apps domain?

You can restrict access for your gmail domain with:

{
  "rules": {
    ".read": "auth.token.email.endsWith('domain.com')",
    ".write": "auth.token.email.endsWith('domain.com')"
  }
}