Firebase in Flutter

Why Firebase?

Building your own server for login, a database and notifications takes time and backend skills. Firebase, by Google, provides these as managed services with official Flutter plugins (the FlutterFire project). Many startups and student projects use it to launch quickly; a separate backend can be added later if needed.

Setup with the FlutterFire CLI

npm install -g firebase-tools        # the Firebase CLI (one way to install it)
firebase login
dart pub global activate flutterfire_cli
flutterfire configure                # choose a project and platforms; creates lib/firebase_options.dart
flutter pub add firebase_core firebase_auth cloud_firestore

import 'package:firebase_core/firebase_core.dart';
import 'package:flutter/material.dart';
import 'firebase_options.dart';

Future<void> main() async {
  WidgetsFlutterBinding.ensureInitialized();      // needed before async work in main
  await Firebase.initializeApp(options: DefaultFirebaseOptions.currentPlatform);
  runApp(const MyApp());
}

Authentication

final auth = FirebaseAuth.instance;

Future<void> signUp(String email, String password) =>
    auth.createUserWithEmailAndPassword(email: email, password: password);

Future<void> signIn(String email, String password) =>
    auth.signInWithEmailAndPassword(email: email, password: password);

// Listen to login state anywhere:
// StreamBuilder<User?>(stream: auth.authStateChanges(), builder: ...)

Firebase Auth also supports phone number sign-in with OTP (popular in India), Google sign-in and others. Phone auth sends real SMS, which has costs at scale and needs extra setup on each platform; use the test phone numbers feature during development.

Cloud Firestore

Firestore is a NoSQL document database: data is stored in documents (like JSON objects) grouped into collections. Reads can be one-time (get) or live (snapshots), which return a stream that updates the moment data changes, ideal for chat, order tracking and live dashboards.

final orders = FirebaseFirestore.instance.collection('orders');

Future<void> placeOrder(String uid, String item) => orders.add({
      'uid': uid,
      'item': item,
      'status': 'placed',
      'createdAt': FieldValue.serverTimestamp(),
    });

Widget myOrders(String uid) => StreamBuilder<QuerySnapshot<Map<String, dynamic>>>(
      stream: orders.where('uid', isEqualTo: uid).orderBy('createdAt', descending: true).snapshots(),
      builder: (context, snap) {
        if (!snap.hasData) return const Center(child: CircularProgressIndicator());
        final docs = snap.data!.docs;
        return ListView(children: [for (final d in docs) ListTile(title: Text(d['item'] as String), subtitle: Text(d['status'] as String))]);
      },
    );

Security rules: essential

Your app talks to Firestore directly, so the database must decide who may read and write what. Security rules, written in the Firebase console, do this on Google's servers. Test mode allows open access for a short time; before real users arrive, write rules such as "a user may only read and write their own orders". Leaving rules open has exposed many apps' data.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /orders/{orderId} {
      allow read, update: if request.auth != null && resource.data.uid == request.auth.uid;
      allow create: if request.auth != null && request.resource.data.uid == request.auth.uid;
    }
  }
}

More services

• Crashlytics: crash reports with stack traces from real users.
• Cloud Messaging (FCM): push notifications, with firebase_messaging.
• Cloud Storage: user uploads like profile photos.
• Analytics and Remote Config: usage data and server-controlled settings.

Pricing: Firebase has a free Spark plan with limits and a pay-as-you-go Blaze plan; some features need Blaze. Read the current pricing page, set budget alerts, and avoid queries that read whole collections.

Common mistakes

• Forgetting WidgetsFlutterBinding.ensureInitialized() before Firebase.initializeApp.
• Shipping with test-mode or open security rules.
• Reading entire collections on every screen open: slow and costly. Filter and limit queries.
• Not declaring Firebase's data collection in the Play Store Data safety form and App Store privacy details.