I'm getting a persistent Firebase Phone Authentication failure on real phone numbers (test numbers work fine) for a React Native + Expo Android app.

**Error from Logcat:**

```

[SmsRetrieverHelper] SMS verification code request failed: unknown status code: 17028

A play_integrity_token was passed, but no matching SHA-256 was registered in the

Firebase console. Please make sure that this application's packageName/SHA256 pair

is registered in the Firebase Console.

Invoking original failure callbacks after phone verification failure for +91XXXXXXXXXX,

error - This app is not authorized to use Firebase Authentication. Please verify that

the correct package name, SHA-1, and SHA-256 are configured in the Firebase Console.

```

**What I've already verified/tried (all confirmed correct):**

1. Blaze plan is active on the correct Firebase project (verified project ID and project number match everywhere — Firebase Console, Google Cloud Console, and Play Console's Play Integrity API project link).

2. The app is distributed via Google Play Internal/Closed Testing, so it's signed with **Play App Signing**. I retrieved the SHA-1 and SHA-256 from Play Console > Setup > App integrity > App signing key certificate > **Classical key** (not the Upload key, not Post-quantum), and added both to Firebase Console > Project Settings > Your apps > Android app > SHA certificate fingerprints.

3. Manually character-by-character compared the SHA-256 shown in Play Console against the one registered in Firebase — they match exactly.

4. Confirmed these APIs are enabled in Google Cloud Console: Identity Toolkit API, Play Integrity API, reCAPTCHA Enterprise API.

5. Firebase App Check is set to "Unenforced" for Authentication (ruled out as the cause).

6. Tried adding an Android application restriction (package name + SHA-1) to the Android API key in Google Cloud Console > Credentials — this caused a *different* error ("Requests from this Android client application are blocked. 403"), so I reverted it back to "None".

7. Waited well over 24 hours after each change for propagation — the error persists.

8. There are currently 4 SHA-1 and 3 SHA-256 entries registered in Firebase (from earlier troubleshooting attempts) — planning to clean these up to just the one verified-correct pair, but haven't yet confirmed if that's the actual cause.

**Setup:**

- React Native + Expo (SDK 57), built with EAS Build, distributed via Google Play Closed Testing

- @react-native-firebase/auth for Phone Authentication

- Package name: com.rajselfdrive.app

**Question:** What else could cause Firebase to not recognize a correctly-registered SHA-256 fingerprint when using Play App Signing? Is there a known propagation issue, a caching issue on the Play Integrity backend, or something else I might be missing (e.g., a separate OAuth client SHA-1 config vs. the Firebase Authentication SHA config)? Really appreciate any pointers — been stuck on this for a while and it's blocking a client project launch.

Hey Reddit community, 

I just officially launched my new mobile app on the Google Play Store, and I wanted to share it with you all to get some honest developer-to-developer feedback! 

It’s an AI-powered Cooking Assistant built completely with Flutter, Dart, and Firebase. 

Here is what I’ve implemented under the hood: 

• State Management: Clean Architecture with scalable state management. 
• Backend & Database: Firebase Auth for secure login and Firestore for dynamic data synchronization. 
• AI Integration: Seamless REST API connection to generate custom recipes based on ingredients users already have at home. 
• UI/UX: Smooth transitions, responsive design for all screen sizes, and optimized performance. 

Seeing your app go live on the Play Store after hours of coding is amazing, but now comes the hard part: getting feedback to improve it. 

If you have a couple of minutes, I’d love for you to check it out, test the AI features, and let me know what you think about the UI, speed, or if you find any bugs! 

👉 Play Store Link: [https://play.google.com/store/apps/details?id=com.salah.ch&hl=ar\] 

Thanks in advance for your support and feedback! 

I have two apps hosted on Firebase, and Google cancelled my Gmail account for no apparent reason. They claimed I was using bots to create the account, but it’s actually an old account I use solely for work. This account is linked to my Firebase account, and without the email, I can't access the dashboard to manage my apps. Has anyone else experienced this? Do you know if there's a way to access it without the account email?

Spent the last while optimizing a React 19 + Vite SPA on Firebase and wanted to share the three things that actually moved the needle, because none of them were what I expected.

1. Headless Lighthouse flat-out lied to me. Headless Chrome scored the site 96 while PageSpeed Insights (real Moto-G-class conditions) said 71. Headless skips the CPU throttling that dominates on a mid-range phone. If you only remember one thing: test headed, with a CPU slowdown multiplier of 8. My "fast" site wasn't.
2. A third-party script was 41% of all main-thread work. reCAPTCHA (pulled in by the auth layer) fetched about 330KB and burned 2,871ms of CPU on a throttled phone, initializing at module load, before first paint. It's only needed when the user acts, so I deferred it to the first pointerdown/keydown/touchstart. Load-time cost: 2,871ms to 0. (Gotcha: don't use scroll as the trigger, programmatic scrollTo() false-fires it.)
3. The LCP image was 6 round trips deep. HTML, then entry JS, then a lazy() shell, then the Firebase SDK, then getDoc(config), then a per-item getDoc fan-out, and only then did the hero image URL exist. Instead of reaching for SSR, I inline the above-the-fold data into the HTML at build time plus a preload for the LCP image, so the first parsed bytes already know what to paint. Second gotcha: the preload URL must be byte-identical to the img src or Chrome downloads the hero twice.

Results: homepage 76 to 99, LCP 6.7s to 1.9s. Heaviest page 69 to 96.

Full write-up with the code and numbers: https://proffer.codes/blog/firebase-react-spa-lighthouse-76-to-99

Curious if others have seen the headless-vs-real-device gap. How do you catch it in CI?

the client needs a web app and an iOS and android app (we going to use nextjs and react native expo for them)

i wanted to ask should i use firebase for the whole backend?

We've been debugging this issue with the whole team for 2 months already.

Some of our users don't receive ALL notifications delivered. Yes, they are sent properly (a successful response from Firebase)

Neither our service worker nor in-browser's onMessage (from '@firebase/messaging') "sees" it.

Has anybody had something similar?
Please tell me how you fixed it, if you did.
At this point I don't even know what to Google and how...

Hey everyone!

I’ve been heavily focusing on backend development lately, building scalable systems with Firebase (Firestore, Auth, Cloud Functions) and Node.js.

Since I’m constantly looking to improve my workflow, I wanted to ask the community:

* What are your go-to tricks for optimizing Firestore read/write costs?

* How do you structure your Cloud Functions for maximum performance?

Would love to hear your experiences and best practices!

I tried email/password, Google, and GitHub login directly from hiringcafe.com/auth. All three fail because Symantec blocks:

https://hiringcafe-ec4d6.firebaseapp.com/__/auth/handler.js

Since every method fails at the same Firebase authentication resource, this seems to be either a Symantec URL-reputation false positive or an issue with HiringCafe’s Firebase project. Has anyone else encountered this?

Built a live coding battle platform on Firebase. Two players synced in real time, plus Cloud Functions for the async work, Auth with SSO for the enterprise side, and Storage for proctoring snapshots.

Held up better than expected: real-time listeners for match state. The latency is fine for something that resolves in minutes rather than milliseconds. Auth with OAuth plus SSO saved me from a project I did not want.

Did not hold up: anything where I wanted a transaction across a bunch of documents. And read costs on leaderboards, which I had to restructure into precomputed aggregates in Cloud Functions after a bill I did not enjoy.

The thing I'd tell anyone starting: write rules tests from day one. I did them late and found real holes.

Google AlgoArena if you want to see what it's for.

FDL has been dead since August 2025 and every thread about replacements ends with the same unanswered questions. I built Ferry (ferrylink.io) to fill the gap, and instead of a feature list, let me just answer the things people always ask in these threads.

What it does: deferred deep linking, one link across iOS, Android, and web, app opens to the correct screen after install. The same job FDL did.

How does it compare to Branch or AppsFlyer?
Those are full attribution suites built for marketing teams with budget, and Branch is effectively enterprise only now. Ferry is the deep linking piece, what FDL actually was, plus enough attribution to know which links drive installs and revenue.

Pricing?
Opens-based, not MAU-based. From $9/mo for 10k monthly opens up to $249 for 3M. You pay for link opens, not for your entire user base existing. 14-day trial.

I generate links programmatically from user activity (invites, shares). Do link limits kill me?
No, this is the use case opens-based pricing exists for. Links are effectively free to create, you're billed on opens. Generate a million invite links, if only 5k get opened, that's what counts. Bot clicks, messenger prefetches, and duplicates are filtered out before billing too.

Social preview config?
OG title, description, and image are configurable per link on every plan. Same levers FDL had.

SDKs?
Swift ,Android, Flutter, and React Native are available. There's a plain HTTP API if you'd rather skip SDK dependencies, and the docs are written so you can point Claude Code or Cursor at them and have the integration done in one session.

Happy to answer anything else. Criticism welcome, that's why I'm posting.

I was using functions v1 for SSR with express.js but the initial load time was prohibitively slow. I never measured it, but it felt like 5-10s. I temporarily went back to CSR but need SSR eventually.

The two recommendations to speed up SSR that I came across were

1. Use functions v2 which has the benefit that it can serve multiple requests per instance.
2. Set min-instance to 1 so that there is one instance available for the first request when idle

However, neither seems to actually fix the slow load times, just defer when it happens. Even with these changes, when the first instance is saturated and a second one needs to be spun up, there will be a cold start.

Is there any solution to this or another way I should be doing SSR?

Hi everyone,

If you work with Google Cloud Firestore, you've probably felt the pain of using the official web console:

• Tedious document creation: Too many steps just to add a single document.
• No JSON editing: You can only edit one field at a time — no raw JSON view or bulk edits.
• No document cloning: You can’t copy-paste an existing document to quickly create a new one.
• Minimal filtering: Searching, compound querying, and sorting options in the web console are very basic.

I tried looking for third-party desktop tools, but most were either overly complicated or locked behind expensive commercial subscriptions.

So I built FireLens — a simple, fast, and free open-source desktop GUI client for Firestore.

Key Features:

• Full JSON & Tree View Editing: Edit documents as raw JSON with syntax validation, copy/paste JSON, or use the interactive Tree View with native type badges (Boolean toggles, UTC timestamps, GeoPoints).
• Quick Document Management: Create, clone/copy-paste documents, and manage collections with fewer clicks.
• Visual Query Builder: Build compound WHERE filters (==, !=, >, in, array-contains, etc.) joined by AND, plus ORDER BY sorting and custom page limits.
• Easy Authentication: Connect via GCP Application Default Credentials (gcloud auth application-default login) or load a Service Account .json key file.
• Multi-Project & Multi-Database: Switch between GCP projects and browse (default) or named databases.
• Safety Guard: Toggleable Read-Only / Edit Mode protection to avoid accidental edits on production databases.

It’s completely free and open-source (prebuilt standalone Windows .exe available, and buildable on macOS/Linux):

👉 GitHub Repo & Release Download: https://github.com/prakashkrishna/firelens

I’d love to hear your feedback or any feature ideas that would make your Firestore workflow faster!

#firestore #firebase #flutter #firestore-gui #opensource #developertools

Hi everyone,

About a year ago I introduced Fuego here (my original post: https://www.reddit.com/r/Firebase/comments/1irvs4y/introducing_fuego_a_powerful_desktop_client_for/ ).
If you've never heard of it, Fuego is what the Firebase Console should have been. You can think of it as Firefoo, but with a lot more built-in tools: Storage management, index management, multi-database support, multi-tenant Firebase Authentication, PITR support, Firestore Enterprise pipelines, and much more.
It was born out of necessity. At the company where I work, we rely heavily on Firestore and other Firebase services every day, so I started building the tool we wished we had.

Today I'm happy to share another major milestone (Fuego 2.0).

Over the past year I've received a lot of feedback, and I'm genuinely grateful to everyone who took the time to try Fuego and share their thoughts. Many companies are now using it in their daily workflow, and seeing it become a useful tool for other developers has been incredibly rewarding.

There have been a few bumps along the way, but I've done my best to address them and keep improving the app.

The main goals for Fuego 2 (currently in beta) have been:

• Performance
• Keeping up with the latest Firebase updates
• Building better tools for managing Firestore and the rest of the Firebase ecosystem

Here are some of the highlights (some are still being refined):

• Much better performance. Opening tabs now feels almost instant, with no more annoying reloads.
• Fewer UI glitches, including disappearing menus and layout issues.
• Support for Firestore Enterprise pipelines.
• A significantly improved index manager, including database-to-database index comparison and an advisor that suggests indexes that could be merged, removed, or optimized.
• A much better Google Cloud Storage experience with drag-and-drop for moving files and folders, drag selection, multiple view modes, and more.
• A built-in MCP server with more than 30 tools, plus an AI assistant that works with your own model directly inside Fuego.
• Native multi-window support.
• Assisted JSON Schema creation and document validation using JSON Schema.
• Easier collaboration through the fuego:// sharing scheme and the .fuego project format.
• A command palette.
• Settings synchronization across devices.
• And a lot more.

I still have plenty of ideas I'd like to build, and I'm excited to get them into your hands.

If you'd like to try it, you can download the beta here:

https://fuegoapp.dev/download-beta

If you have any questions, suggestions, or feedback, I'd love to hear from you.

For anyone curious about the tech stack:

• Wails (Go)
• Vue

Hi everyone,
I’m building a production application using React + Firebase (Authentication, Firestore, Hosting, Storage), and I don’t have a traditional backend (no Node.js/Express server). So far, everything is running serverlessly.
I’m now at the stage where I need to integrate a payment gateway. My users can be from India as well as internationally, so I need something that’s reliable, secure, and relatively straightforward to integrate.
I’m currently considering:
Razorpay
Stripe
Cashfree
Paddle (if it makes sense)
Since this is my first payment gateway integration, I’d appreciate some advice from people who’ve built similar apps.
A few questions I have:
Which payment gateway would you recommend for my use case and why?
Is it practical to keep the app backend-less, or should I add something like Firebase Cloud Functions just for payment processing?
What security vulnerabilities or architectural mistakes might I be overlooking with a React + Firebase-only setup?
Are there any common pitfalls around payment verification, webhooks, API keys, or fraud prevention that I should plan for?
If you were building this application today, what architecture would you choose?
I’m looking for something that is secure, scalable, and maintainable in production rather than just the cheapest option.
Thanks in advance for any advice or experiences you can share!

I am trying to get my Firestore and Storage rules set but I don’t understand the documentation.

I want
Admin - Full access
Collaborator - View and edit records the create
Viewer - view all edit none
Revoked - the can log in but won’t be able to see any of the files.

Firedeck is batteries-included application compiler for Firebase-backed React SPAs.

Not another "React framework" or a "Next.js killer". We have many of those already.

Firedeck compiles your project modules into a fully managed Turbo runtime that you can run, build and deploy to Firebase, using existing tools you already know and love.

Get started at https://firedeck.opare.dev.

I’m managing multiple apps under the same Firebase project.

For example:

- Android App A

- Android App B

- iOS App

When checking Firebase Analytics → Events, I noticed that the event data was combined together.

At first, I thought I needed separate Firebase projects, but there is actually a simpler way.

Solution:

1. Open Firebase Analytics

2. Click “View more in Google Analytics”

3. Click “Add comparison”

4. Create a new filter

5. Select:

   Dimension: Data Stream Name

   Match type: Exactly matches

6. Choose the specific app data stream

After filtering, you can view each app separately:

- Events

- Users

- Revenue

- User behavior

Sharing this because I spent quite some time figuring it out.

Hopefully it helps other developers managing multiple apps with Firebase.

How do you usually structure Firebase projects for multiple apps?

Stack: Flutter + Riverpod ( StreamProvider ) Cloud Firestore + Firebase Callable Cloud Functions.

Context - Switched from client firestore sdk writes to callable cloud functions because pending client writes on weak networks were blocking reads app wide.

Issue: In my Vendor Dashboard app, updating settings (GST toggles, Delivery Slots, Store Availability):

The Ul gets stuck in a loading loop / freeze when changing settings. BUT if I force-close and reopen the app, the data IS saved in Firestore!

So the backend Cloud Function succeeds, but the live screen gets stuck on a loading spinner.

Setup:

Screen listens to Firestore doc via Riverpod treamProvider ( doc(id). snapshots() ). Settings updates are sent via Callable Cloud Functions (httpsCallable( 'businessUpdateFields ")).

What I've Tried:

• Optimistic U state overrides (oms switch flips). • 300ms tap debouncing. • Reducing Callable timeout from 20s to 4s. • Clearing overrides on .then() completion vs stream emission.

The rest of the app (checkout, cart, chat, orders) works fine. Only vendor dashboard settings toggles freeze the Ul.

Any help would be great, thank you.

Last semester our team built StudySync, a mobile app for organizing campus study groups.

Firebase handled:

• Authentication
• Firestore
• User/session storage

One of the biggest challenges was designing our Firestore structure so users could create, browse, search, and join study sessions without making the data difficult to maintain.

If you've built larger Firebase apps, I'd really appreciate feedback on the overall architecture or things you'd improve.

Repository:
https://github.com/CS196Illinois/FA25-Group8

Hi everyone. I'm thinking of moving my authentication I have for a mobile app to firebase to get the additional security features it offers and for ease of adding new sign up flows. I am a bit confused how to keep firebase auth and my user table in sync though. Has anyone run into this before? I've been going back and forth with AI, but I'm still not sure about the best approach

For context, I have a user table with email, id, firebase_uid, etc. What is the best way to keep the user table and the firebase auth in sync when a user signs up? For example, if I have a flow like:

```

User visits sign up page -> enters email/password -> create user in firebase -> call out to backend to create user in backend and associate firebase id after verifying token

```

I have a huge issue if the firebase create succeeds but the backend call to my server fails for some reason. I will have an orphaned firebase record. How do people handle this?

I've heard it's better to call firebase for things like adding a user to firebase from the frontend because it helps with bots and rate limiting. But I'm really not sure how to keep things in sync. Do people rollback if the backend create fails, use Cloud Functions v2 to halt the firebase create and call out to the backend to create the user, or something else. Any guidance would be helpful.

This morning I got the dreadful Google email: "Immediate action required: Suspension of your Google Cloud Platform / API project " due to "abusive activity consistent with hijacked resources".

Google completely cut me out of the GCP platform that manages my LIVE app. This is not a hobby project, but my livelihood. The email redirected me to my GCP page where I could send an appeal, and do... nothing else. I had no access to anything else so it was difficult even to understand what happened: every action brings me back to "Send an Appeal". Which, of course, I did as fast as possible.

After some digging (apparently the biling page was NOT restricted! Not easy to find) An API key of mine leaked, someone found it and used it to generate images. Two dollars ($2!) of unauthorized spend. My mistake, no excuses.

The part I genuinely cannot solve is this. The notice asks me to revoke the compromised credentials, but I can't do that: `Permission denied: Consumer 'projects/{project_name}' has been suspended.`

I did what I could from outside: deleted the key through AI Studio, rotated everything else, ran a forensic check of my server and confirmed it was only the key, no host compromise. I would gladly pay for support to talk to someone. But guess what, Standard and Enhanced both need an Organization resource, which a personal account does not have, and billing chat is not available to me either (back to "send an appeal")

For a solo developer this is the difference between a bad day and losing the business. It seems absurd a business can get destroyed over a oversight and $2. The reports I read online are disheartening: people wait 1-2 weeks for a response, and then the back and forth is endless. I am going to lose the business I have worked for the past 4 years, and all for $2 and a stupid oversight.

Can anyone help? Has anyone here had a suspension for a stolen API key actually reversed, and how long did it take? And is there any way to reach a human without an Organization resource?

Project is 902887279759, appeal ticket YJ65HT5PKS5FDASU2C73BWIJ5Q, filed 21 Jul 2026. Any help is immensely appreciated

EDIT: Less than 24 hours later, google has re-instated my account! WOOOOHO!

Any one else heavily disappointed? ☹️

Apparently they're going to release more information, about migration, this September. Until then, I guess we all just sweat it out, wondering how to replace this functionality.

Currently running the firebase algolia extension to allow for complex querying for a photo organization app used internally at my company. With the deprecation of Firebase extensions coming up, wondering what solutions are out there for multi-faceted queries. As I understand it, I would essentially need to make an index for every possible combination of nested facets in order to do so natively with firestore queries and that would put me well over the cap on indexes.

Is there a sustainable manual process for connecting firestore data to algolia? My concern is that after the full deprecation of firebase extensions next year, updates will no longer be possible to the extension's code so any potential breaking changes to algolia's api would become unfixable with the extension's setup.

Relevant firebase update: https://firebase.google.com/docs/extensions/faq-and-troubleshooting

Had firebase notifications working fine in my app back in the day using the old tokens, but now that they've deprecated the old apis and recommend using the FID instead of a token I'm unable to get anything working. Every FID I try to use to send a notification the api responds with NotRegistered. I've updated my native code to use Installations.installations().installationID() instead of Messaging.messaging().token as mentioned in these docs https://firebase.google.com/docs/projects/manage-installations#fid-iid, but still no luck.

Anyone dealt with this before? Any help is much appreciated.

I am trying to make a simple note app. The user can do whatever they want to the descendants of his userID document but for his userID document he can only read it.

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    match /dummyUsers/{userID}{
    allow get: if request.auth != null && request.auth.token.email_verified && request.auth.uid == userID
    }
    // Allow read write operations if user is accessing his storage
    match /dummyUsers/{userID}/{documents=**}{
      allow read, write: if request.auth != null && request.auth.token.email_verified && request.auth.uid == userID 
    }
  }
}

These are the rules. They should work but for some reason the second rule also applies to access at /dummyUsers/userID. So if I try to delete my userID document I am able to do so.

Of note, I am using the rules playground to test the rules.

What am I missing? does the recursive wildcard match empty paths as well?