Hey Stefan,
You have 2 options for CI environments:
1) On the CI server itself, run:
firebase login --no-localhost
This takes you through a separate login flow that involves copying and pasting the URL into a browser on a different machine and then copying and pasting a verification code back into the console of the CI server. It logs your CI server in and stores the token in the home directory of the current user so subsequent firebase commands just work.
2) On your development machine, run:
firebase login:ci
This creates a completely new login session on your development machine (it's not stored anywhere and doesn't affect your current login session). The output is an OAuth refresh token, but that's an implementation detail. To use this token, you need to pass it into every command you want to run with the --token flag, like:
firebase deploy --token $FIREBASE_TOKEN
The advantages of the first method include not having to worry about passing around the token to every command, and a cached OAuth access token between requests (they last for 1 hour at most). The advantages of the second method include much more granular control over who has access to the token and the ability to put the token in an environment variable (useful for scripting deploys, or CI services like travis so it doesn't have to be in the code)
Hope that helps
Chris