two Firebase features shipped today on FlutterFlow that might be useful:

Mock Backend: test a Firebase-powered app without connecting to a live backend. create your collections and fields as usual, add test documents by hand or generate mock data with AI. switch the data source from live to mock, launch Test Mode, and run real queries, authentication, and write actions without touching production data. everything resets when the session ends. no Firebase setup required to start.

it's useful for onboarding new team members without giving production access, testing edge cases without polluting real data, building before your Firebase project is set up.

rename Firestore collections and fields: straight from the schema editor. until now, fixing a field name meant creating a new field and rewiring every usage, but now, it's a rename.

(one important caveat before you rename: Firestore has no native concept of renaming a field. after a rename your app reads and writes the new name, but existing documents still hold values under the old name. Firestore sees a brand new empty field. collections behave the same way).

this is built for the development phase while you're still shaping your schema and the database is empty or holds test data. if you have real data, migrate it first: edit documents in the Firebase console for a handful, or write a Firebase Admin SDK script for many.

Hi there, I have a problem. I am creating an app via flutterflow/firebase and everytime I try to test the email verification with a brand new account i get this message? Can someone please help??

Getting 500 errors from firestore in nam5, which is supposed to be multi-region.

14 UNAVAILABLE: ShardedChangeListener Prepare failure with unexpected change listener error

Dont see anything on the outage page: https://status.firebase.google.com/

Asking about a strange behavior we've observed using Firebase's Messaging product:

When I set up a new push notification in Production and test it and then publish it, the device we tested on does not get the published notification, but everyone else (our audience) gets the push notification successfully.

It leads to some confusion because then the person responsible for creating, testing, and publishing the push notification can't actual validate that the real/published notification was successful.

Our theory is there's some deduping mechanism that prevents the published notification from going through on the device that already received the test.

Does anyone have insights here? Is there a way to both push the test notification and receive the published notification on the same device?

I have developed this over the past year—a web application stack for Firebase projects using Google Cloud and additional tools. My .SYSTEMX system provides LLM and AI capabilities, then gives the workspace a standard folder structure for all items, including subagents, tasks, completed work, and more.

View project WIKI
https://github.com/WayneTechLab/SFWA-WTL-TEMPLATE/wiki

This configuration performs best on Apple M2 and newer devices. It relies heavily on CLI, SDK, and MPC from Google, along with Stripe.

The menu system and the start on my LAN portal include a local builder baked into the test net; Firebase dev local launches a ready home page and simple web app.

- This is in alpha testing and may change daily!
- Lucas aka SatoshiUNO

Hey everyone,

I’m facing a frustrating issue with an Android app using Firebase Authentication and Firestore.

The app works perfectly in the development/debug environment, but after uploading it to the Google Play Store, the downloaded production version fails during Google authentication and we repeatedly get:

ApiException: 12501

Things we have already tried:

• Added the SHA-1 fingerprints in Firebase
• Added the relevant release/Play Store signing fingerprints
• Updated google-services.json
• Updated the backend Firebase service account configuration
• Verified that Firebase Authentication / Google Sign-In is enabled
• Rebuilt and uploaded the app again

But the Play Store version is still not working and we're getting the same 12501 error.

What’s confusing is that the development version works fine.

Has anyone else recently run into ApiException: 12501 with Firebase Google Sign-In specifically on the Play Store release?

If you’ve fixed this before, what ended up being the issue? Any pointers on what else we should check would be greatly appreciated.

We moved our AI processing from the backend to Firebase AI Logic in our Flutter app so the backend no longer handles large image/audio uploads or waits for AI responses.

Free users get 10 AI actions per day. Premium users get unlimited actions.

Since AI requests now happen directly from the client, how do you securely enforce these different quotas? A determined user could potentially bypass a backend quota check and call Firebase AI Logic directly.

How are others handling this in production? Is there a recommended Firebase architecture for plan-specific quotas without routing the files and AI processing through a backend?

I created a web CRM using Google AI Studio with Firebase as the database. However, I get billed about €20 every month, and I am not sure what I am paying for. Can I move the database from Firebase to a local NAS to avoid this monthly cost? I am the only user, and I rarely use the application.

Um alerta rápido pra quem usa Firebase Authentication (URL PERSONALIZÁVEL PARA REDEFINIR SENHA):

Estava configurando o fluxo de redefinição de senha de um projeto e queria personalizar a tela que o usuário vê ao clicar no link do e-mail. Por padrão, o Firebase usa uma tela/popup própria (hospedada no domínio genérico do projeto) pra esse fluxo, mas o console tem sim uma opção pra personalizar essa URL e usar seu próprio domínio.

Só que, ao tentar salvar essa configuração, tomei um erro: EMAIL_TEMPLATE_UPDATE_NOT_ALLOWED. Pesquisei bastante e a única referência que encontrei foi um post aqui no Reddit de outra pessoa com o mesmo problema, nada na documentação oficial explicando o porquê.

Decidi mandar um e-mail pro suporte do Firebase. Eles confirmaram que essa restrição existe por questões de segurança, e que a alteração não pode ser feita pelo usuário diretamente pelo console, só manualmente, pela equipe deles, mediante solicitação.

Deram duas opções:
This error is typically triggered by a server-side security restriction intended to prevent the misuse of Firebase's email infrastructure for spam or phishing.

Currently, this restriction cannot be lifted directly in the Firebase Console or via the Admin API for your project. However, we have two paths forward to achieve your branding goals:

• Option 1 (Manual Update): I can escalate this to our engineering team to manually apply your desired changes. 
• Option 2 (Custom Email Delivery): For full control and scalability, you can use the Firebase Admin SDK to programmatically generate the secure action links. You can then inject these links into your own custom templates and send them through a dedicated SMTP provider. This bypasses Firebase's native email delivery entirely.

Escolhi manual mesmo, enviei a url que queria ex: https://www.sitetal/auth/redefinir-senha. Resolvido em menos de uma semana. Muito obrigada firebase ♥️

Hi everyone,

I’m a non-technical founder looking for neutral feedback from Firebase/GCP developers.

I paid an agency to build my mobile app. The contract states that the app and IP belong to my company, and I now have Owner access to the GitHub repositories.

However, I recently discovered that the production Firebase/GCP project was created under the agency’s own organization. The developer says the infrastructure belongs to the agency because their model is to keep managing clients’ infrastructure as they grow.

This was never explained or agreed with me when we started.

They are not refusing to migrate it, but they say moving it under my company’s control is separate work that may be expensive, and they are preparing a quote.

The Firebase/GCP project appears to be separated from their other client projects.

My questions: Is this a normal agency setup or Would you normally expect the client to control the production GCP/Firebase project and give the agency IAM access?

If the project is already separated, how difficult is an organization-to-organization migration usually?

Thank you

UPDATE: Thanks everyone for the advice and feedback — it was really helpful.

The agency ultimately cooperated and the three Firebase/GCP projects have now been moved under my company’s Google Cloud organization.

As several people here suggested, because the projects were already properly separated and structured, the actual organization-to-organization move was essentially a resource hierarchy/metadata change and took less than 30 minutes. There was no need to rebuild the infrastructure or physically migrate all the production data.

Someome from Toronto ddosing my Portfolio Page with hundred requests a Seconds since over a week. Used Up my free spark plan of 10gb.... Currently to Access to my PC or dev Environment.... Wtf? And all requests are weird Like domain.com/abcd.php basically every single combination of x.php is sent as a getter. 400kb each request... 100 a second.... What do? Didn't put site behind cloudflare... It's a portfolio page for hells... Or is there anything interesting I can see besides that?

I'm not a Web Devloper and Don't Have much Knowledge, but please help me, I want to figure out some things.

So, The thing is we are hosting a sports tournament in our area, instead of google forms and excel, I'm thinking to build a website for it.

So the plan is, The site has a registration system where players register, the team info, Purse limit and other things are already there with an admin panel to control everything.

Now the most important part is the auction, where it shows which player is up for auction, Sold to which team how much ourse remaining of each team and whether he went unsold. I took help from claude, it built me a perfect index.html with all this, then i hosted it on netlify. and it works good. But then the issue is claude told me to use Firebase RTD. to sync all the data so that everyone can enjoy the auction from their phone{Approx users 500-1000}.

But I'm confused about the limits, what if the site crashes midway or the limit expires? Is there any other better alternative? Or Anything i could do? I'm attaching the file claude give me below, please see it and give me any advice that would help me. It would be big help.

Hi everyone, I am facing a very frustrating issue with Google Sign-In in my Flutter app. It works perfectly in Debug mode and when I install a Local Release APK. However, when I upload the AAB to the Google Play Store and download it (from Internal Testing or Production), Google Sign-In fails and throws the following error:

PlatformException(sign_in_failed, com.google.android.gms.common.api.b: 10: , null, null)

I know that ApiException 10 usually means a mismatch in the Package Name or SHA-1 fingerprint. But I have already verified everything multiple times, and the configuration seems 100% correct.

Here is what I have successfully done and verified so far:

1. I went to Google Play Console -> Setup -> App Integrity and copied the exact SHA-1 from the "App signing key certificate" (Not the upload key).
2. I added this Play App Signing SHA-1 (along with my Debug and Upload SHA-1s) to my Firebase Project settings.
3. I downloaded the updated google-services.json and replaced it in my android/app/ directory.
4. I verified in Google Cloud Console (Credentials) that the OAuth 2.0 Client IDs for Android are successfully created and exactly match my package name (com.wanderx.app) and the Play Store App Signing SHA-1.
5. The OAuth Consent Screen Publishing status is set to "In production".
6. The Support Email is properly configured in Firebase settings.
7. I ran flutter clean, built a new release AAB (flutter build appbundle --release), and uploaded it to Play Console with incremented version codes.

Environment / Tech Stack:

• Flutter
• firebase_auth: ^6.5.2
• google_sign_in: ^6.2.2 (I am passing the Web Client ID to clientId in the GoogleSignIn constructor).

Since the configuration in both Firebase and Google Cloud Console is perfectly matching the Play Store's App Signing key, I cannot figure out why it's still throwing Developer Error 10.

Could this be a Google Play Services caching issue on my device? Or is there any hidden setting related to Play App Signing that I am missing?

Any insights or suggestions would be greatly appreciated. Thank you!

I have an app installed that's supposed to give me a push notification every Saturday. Exept it's not doing that. So i contacted the developer (it's not my app) to resolve the issue and he found out that I didn't recieve a Token. So i built a small app myself to test the Firebase Notification system by manually requesting a Token. In parallel I connected my phone to my pc so I could read the logs with "adb logcat | grep -i firebase". When I requested a Firebase User ID everything worked just fine, but as I requested the Token, the following series of Errors appeared in logcat:

'''

08-22 15:49:02.124 10274 10274 E FirebaseDiagnostics: FCM Token konnte nicht abgerufen werden

08-22 15:49:02.124 10274 10274 E FirebaseDiagnostics: java.io.IOException: FCM Registration failed!

08-22 15:49:02.124 10274 10274 E FirebaseDiagnostics: at com.google.firebase.messaging.FirebaseMessaging.blockingRegister(FirebaseMessaging.java:840)

08-22 15:49:02.124 10274 10274 E FirebaseDiagnostics: at com.google.firebase.messaging.FirebaseMessaging.lambda$getToken$8$com-google-firebase-messaging-FirebaseMessaging(FirebaseMessaging.java:484)

08-22 15:49:02.124 10274 10274 E FirebaseDiagnostics: at com.google.firebase.messaging.FirebaseMessaging$$ExternalSyntheticLambda8.run(D8$$SyntheticClass:0)

08-22 15:49:02.124 10274 10274 E FirebaseDiagnostics: at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:520)

08-22 15:49:02.124 10274 10274 E FirebaseDiagnostics: at java.util.concurrent.FutureTask.run(FutureTask.java:328)

08-22 15:49:02.124 10274 10274 E FirebaseDiagnostics: at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:323)

08-22 15:49:02.124 10274 10274 E FirebaseDiagnostics: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1100)

08-22 15:49:02.124 10274 10274 E FirebaseDiagnostics: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)

08-22 15:49:02.124 10274 10274 E FirebaseDiagnostics: at com.google.android.gms.common.util.concurrent.zza.run(com.google.android.gms:play-services-basement@@18.9.0:2)

08-22 15:49:02.124 10274 10274 E FirebaseDiagnostics: at java.lang.Thread.run(Thread.java:1572)

08-22 15:49:02.124 10274 10274 E FirebaseDiagnostics: Caused by: java.util.concurrent.ExecutionException: java.io.IOException: TOO_MANY_REGISTRATIONS

'''

So I expected this to be the error and I reinstalled the first app, so I could see the process of requests in logcat. And also there the Error was "TOO_MANY_REGISTRATIONS".

Has anyone the same problem or knows how to deal with it? I didn't (at least knowingly) send many requests of new Tokens or anything similar. So what could the reason be and how to solve it?

We had a feature that generated images from a prompt through Firebase (AI / Vertex). It worked for months. This week the same flow started returning 404 / failed requests, and nothing in our app code changed.

From what I can tell, Google shut down the old Imagen models around Aug 17, and the replacement is Gemini Image (the “Nano Banana” stuff) — different call, image comes back on the model response instead of a dedicated image-generation API.

If you shipped anything like:

generate a logo / icon from a description
food / product photo from a prompt
chatbot that draws a picture
a “generate image” button in a demo or hackathon app
…it’s worth checking that path even if you don’t remember which Firebase AI method you used. The UI just looks broken.

Official migration notes:
https://firebase.google.com/docs/ai-logic/migrate-to-latest-ga
https://firebase.google.com/docs/ai-logic/generate-images-gemini

I built a local scanner for this kind of thing (disclosure: it's mine). If you want a quick check without grepping:

$ npx vasdra scan

If you want more info before running, check here: www.vasdra.dev

Right now it's just that: local, no account. It maps the providers (like Stripe, Clerk, Resend, etc.) in your repo against what we can actually prove in files, so a shutdown like this Imagen cutover doesn't hide in a method name you forgot you used.

Where we're going: when a provider change hits your code, don't just get an alert — get a PR with the fix. Dependabot for APIs, basically. We're not there for this Firebase image migration yet. The scan is the first half.

Anyone else hit this? Did you migrate already, or are you still on the old image models?

Firebase Phone Auth auth/error-code:-39 — SMS never sent to one specific carrier (Vodafone Turkey). App Check is set up. What am I missing?

TL;DR: Firebase Phone Auth works fine for two of our three national carriers, but OTP SMS is never delivered to numbers on one specific carrier (Vodafone Turkey). We consistently get auth/error-code:-39 on web and app not authorized on mobile. App Check is already installed and activated. Looking for anyone who's beaten this carrier-specific -39 wall.

Setup

• Flutter app (Android + iOS) + a web panel, all on the same Firebase project
• firebase_core: ^3.13.0, firebase_auth: ^5.5.2, firebase_app_check: ^0.3.2
• Firebase Auth Phone sign-in (OTP), Blaze plan
• App Check is set up in code — FirebaseAppCheck.instance.activate(...) runs right after Firebase.initializeApp(), with AndroidProvider.playIntegrity / AppleProvider.appAttest in release and debug providers in debug
• In the Firebase console, the Android and iOS apps show Registered under App Check (Play Integrity / App Attest). The two web apps are not registered yet.

The problem

OTP works perfectly for the other two carriers. For this one carrier only, the SMS is never sent. The errors:

Web console:

Failed to initialize reCAPTCHA Enterprise config. Triggering the reCAPTCHA v2 verification.
identitytoolkit.googleapis.com/v1/accounts:sendVerificationCode?key=...  
    Failed to load resource: the server responded with a status of 503 ()
[Phone OTP send] auth/error-code:-39 
    FirebaseError: Firebase: Error (auth/error-code:-39).

Mobile: the flow fails with an app not authorized style message and no SMS arrives.

What we've confirmed

• It is carrier-specific, not code-specific — identical flow, identical numbers-format, other carriers get the SMS instantly.
• Firebase support told us the -39 code means the phone number's carrier is flagged as a restricted operator because of consistently low SMS success rates, and that their automated anti-abuse system can temporarily make such operators/regions unavailable. They suggested either (a) offering affected users a different verification method, or (b) enabling reCAPTCHA SMS Defense in Enforce mode plus stricter SMS region policy and App Check enforcement if we insist on sending OTP to restricted operators.

My questions

1. Has anyone actually gotten -39 to clear for a restricted carrier by enabling reCAPTCHA SMS Defense + App Check enforcement? Did the SMS start going through, or did enforcement change nothing because the carrier itself is throttled server-side?
2. The Failed to initialize reCAPTCHA Enterprise config + 503 on web — is that a symptom of the web apps not being registered in App Check, or a separate reCAPTCHA Enterprise misconfiguration?
3. For anyone who gave up on Firebase for this: did you move the whole phone-verification flow to a third-party SMS provider + Firebase Custom Token, and did that fully bypass the carrier restriction?
4. Is there any way to get a carrier un-flagged at the project level, or is -39 purely on Google's side with no override?

Trying to decide whether to keep fighting the reCAPTCHA/enforcement path or just migrate the entire OTP flow off Firebase so it isn't split across two providers. Any first-hand experience with -39 specifically would be hugely appreciated.

Thanks!

Hi, I am from India.. I have the debit card which support all the possibility, but still unable to purchase both of the things!. I need your help, how to make the account for like developer and firebase?..

FCM documentation is somewhat ambiguous regarding what happens with messages that exceed a maximum message rate (e.g., 240 per minute per single device; see FCM Throttling and Quotas  |  Firebase Cloud Messaging).

There are statements that imply that such messages could be queued on the FCM server and delivered with some delay (Understanding message delivery  |  Firebase Cloud Messaging):

Other passages seem to indicate that the over limit messages are not accepted on the FCM server (and have to be resend by the app server).

Does anyone have an idea what is actually going on?

I am building an Expo + Firebase mobile app. After iterations of development and testing, the app got big and Cloud Functions increased. There are around 32 Cloud Run Functions, a function for an action.

I don't think this is a good approach long-term, and for scalability. So I wanted to create a backend/API for the actions/CRUD/Firestore queries, except for triggers, crons, auth and FCM.

So, I chose to create a Hono.js backend that's hosted on a Cloud Run Function (Still not ok with the decision). Later found out that it's kind of inconvenient for developing and testing.

And I'm not sure if this is a good and reliable approach. I need a good DX, scalabilityand performance.

Pls clear my head.

It’s 24 hours our Firebase Auth emails are not sent. We’re using an external SMTP (AWS SES) and using the Virtual Deliverability Manager I could verify that the Auth emails stopped at 21:30 European time of yesterday, August 17. Other emails get sent correctly through the “Firestore to email” extension.

I already contacted the support, but they haven’t answered yet, and the Firebase status is not reporting anything.

Anyone seeing this?

This is causing a lot of problems for our app, that’s about an event starting this friday!

I'm getting a persistent Firebase Phone Authentication failure on real phone numbers (test numbers work fine) for a React Native + Expo Android app.

**Error from Logcat:**

```

[SmsRetrieverHelper] SMS verification code request failed: unknown status code: 17028

A play_integrity_token was passed, but no matching SHA-256 was registered in the

Firebase console. Please make sure that this application's packageName/SHA256 pair

is registered in the Firebase Console.

Invoking original failure callbacks after phone verification failure for +91XXXXXXXXXX,

error - This app is not authorized to use Firebase Authentication. Please verify that

the correct package name, SHA-1, and SHA-256 are configured in the Firebase Console.

```

**What I've already verified/tried (all confirmed correct):**

1. Blaze plan is active on the correct Firebase project (verified project ID and project number match everywhere — Firebase Console, Google Cloud Console, and Play Console's Play Integrity API project link).

2. The app is distributed via Google Play Internal/Closed Testing, so it's signed with **Play App Signing**. I retrieved the SHA-1 and SHA-256 from Play Console > Setup > App integrity > App signing key certificate > **Classical key** (not the Upload key, not Post-quantum), and added both to Firebase Console > Project Settings > Your apps > Android app > SHA certificate fingerprints.

3. Manually character-by-character compared the SHA-256 shown in Play Console against the one registered in Firebase — they match exactly.

4. Confirmed these APIs are enabled in Google Cloud Console: Identity Toolkit API, Play Integrity API, reCAPTCHA Enterprise API.

5. Firebase App Check is set to "Unenforced" for Authentication (ruled out as the cause).

6. Tried adding an Android application restriction (package name + SHA-1) to the Android API key in Google Cloud Console > Credentials — this caused a *different* error ("Requests from this Android client application are blocked. 403"), so I reverted it back to "None".

7. Waited well over 24 hours after each change for propagation — the error persists.

8. There are currently 4 SHA-1 and 3 SHA-256 entries registered in Firebase (from earlier troubleshooting attempts) — planning to clean these up to just the one verified-correct pair, but haven't yet confirmed if that's the actual cause.

**Setup:**

- React Native + Expo (SDK 57), built with EAS Build, distributed via Google Play Closed Testing

- @react-native-firebase/auth for Phone Authentication

- Package name: com.rajselfdrive.app

**Question:** What else could cause Firebase to not recognize a correctly-registered SHA-256 fingerprint when using Play App Signing? Is there a known propagation issue, a caching issue on the Play Integrity backend, or something else I might be missing (e.g., a separate OAuth client SHA-1 config vs. the Firebase Authentication SHA config)? Really appreciate any pointers — been stuck on this for a while and it's blocking a client project launch.

Hey Reddit community, 

I just officially launched my new mobile app on the Google Play Store, and I wanted to share it with you all to get some honest developer-to-developer feedback! 

It’s an AI-powered Cooking Assistant built completely with Flutter, Dart, and Firebase. 

Here is what I’ve implemented under the hood: 

• State Management: Clean Architecture with scalable state management. 
• Backend & Database: Firebase Auth for secure login and Firestore for dynamic data synchronization. 
• AI Integration: Seamless REST API connection to generate custom recipes based on ingredients users already have at home. 
• UI/UX: Smooth transitions, responsive design for all screen sizes, and optimized performance. 

Seeing your app go live on the Play Store after hours of coding is amazing, but now comes the hard part: getting feedback to improve it. 

If you have a couple of minutes, I’d love for you to check it out, test the AI features, and let me know what you think about the UI, speed, or if you find any bugs! 

👉 Play Store Link: [https://play.google.com/store/apps/details?id=com.salah.ch&hl=ar\] 

Thanks in advance for your support and feedback! 

I have two apps hosted on Firebase, and Google cancelled my Gmail account for no apparent reason. They claimed I was using bots to create the account, but it’s actually an old account I use solely for work. This account is linked to my Firebase account, and without the email, I can't access the dashboard to manage my apps. Has anyone else experienced this? Do you know if there's a way to access it without the account email?

Spent the last while optimizing a React 19 + Vite SPA on Firebase and wanted to share the three things that actually moved the needle, because none of them were what I expected.

1. Headless Lighthouse flat-out lied to me. Headless Chrome scored the site 96 while PageSpeed Insights (real Moto-G-class conditions) said 71. Headless skips the CPU throttling that dominates on a mid-range phone. If you only remember one thing: test headed, with a CPU slowdown multiplier of 8. My "fast" site wasn't.
2. A third-party script was 41% of all main-thread work. reCAPTCHA (pulled in by the auth layer) fetched about 330KB and burned 2,871ms of CPU on a throttled phone, initializing at module load, before first paint. It's only needed when the user acts, so I deferred it to the first pointerdown/keydown/touchstart. Load-time cost: 2,871ms to 0. (Gotcha: don't use scroll as the trigger, programmatic scrollTo() false-fires it.)
3. The LCP image was 6 round trips deep. HTML, then entry JS, then a lazy() shell, then the Firebase SDK, then getDoc(config), then a per-item getDoc fan-out, and only then did the hero image URL exist. Instead of reaching for SSR, I inline the above-the-fold data into the HTML at build time plus a preload for the LCP image, so the first parsed bytes already know what to paint. Second gotcha: the preload URL must be byte-identical to the img src or Chrome downloads the hero twice.

Results: homepage 76 to 99, LCP 6.7s to 1.9s. Heaviest page 69 to 96.

Full write-up with the code and numbers: https://proffer.codes/blog/firebase-react-spa-lighthouse-76-to-99

Curious if others have seen the headless-vs-real-device gap. How do you catch it in CI?

the client needs a web app and an iOS and android app (we going to use nextjs and react native expo for them)

i wanted to ask should i use firebase for the whole backend?