Mobile Firebase

One skill for Firebase on every mobile stack. This file holds what is true for every platform and product; setup, APIs and pitfalls live in the references.

For the app-wide lifecycle around Firebase APIs, use mobile-auth for identity/session transitions, mobile-notifications for token bindings and tap navigation, and mobile-privacy for consent and deletion. Open only the workflow relevant to the task.

1. Pick the references

Detect the stack first, then read the platform guide (shared setup and the product list) and only the product guides the task needs:

In a Flutter or React Native app, native code in android/ and ios/ (a notification service, an app extension) follows the native guides.

2. Configuration files are not secrets, but they are not protection either

google-services.json, GoogleService-Info.plist and the Firebase web config identify the project; they ship inside every app and anyone can extract them. What protects data is:

• Security rules for Firestore, Realtime Database and Storage. Rules that allow reads or writes to everyone (allow read, write: if true, or test-mode rules left in production) are a critical finding.
• App Check, so only the genuine app calls Firebase backends and AI Logic.
• Server-side authorization in Cloud Functions: check auth and inputs; never trust the app.
• API key restrictions in Google Cloud for the keys in those files.

3. Environments

Use separate Firebase projects for development and production, selected by build flavor, scheme or configuration — not by editing the config file before a release. Keep production data out of debug builds and out of tests.

4. Local Emulator Suite

Develop and test against the Firebase Local Emulator Suite (Auth, Firestore, Realtime Database, Storage, Functions) instead of production. Connect each product to the emulator before its first call, only in debug builds. The Android emulator reaches the host at 10.0.2.2.

5. Cost and performance

• Real-time listeners bill reads on every change: listen to narrow queries, paginate, and remove listeners when screens go away.
• Offline persistence is on by default for Firestore on mobile; design UI for pending writes instead of waiting for the server.
• Keep Remote Config fetches and SDK initialization off the launch path when possible.

6. Privacy

Analytics, Crashlytics and Messaging collect data covered by store privacy disclosures (App Store privacy details and privacy manifests, Google Play Data safety). Never send personal data (emails, names, phone numbers) as analytics parameters, crash keys or user properties, and honor consent before enabling collection where the law requires it. Event design, tracking plans and analytics identity are in mobile-analytics.

Output

When integrating, list the files changed, the console steps the user must do (enable a provider, upload an APNs key, create an index) and how to verify it works. When reviewing, report rules, App Check and privacy issues first, with file:line.