firebase-auth

Firebase Authentication Skill

This skill defines how to correctly use Firebase Authentication in Flutter applications.

When to Use

Use this skill when:

• Setting up Firebase Authentication in a Flutter project.
• Listening to authentication state changes.
• Implementing email/password, phone number, or social sign-in.
• Managing user profiles, account linking, or MFA.
• Handling authentication errors (including iOS recaptcha-sdk-not-linked for phone auth).
• Applying security best practices for auth flows.

---

1. Setup and Configuration

flutter pub add firebase_auth

import 'package:firebase_auth/firebase_auth.dart';

• Enable desired authentication providers in the Firebase console before using them.
• Initialize Firebase before using any Firebase Authentication features.

Local emulator for testing:

Future<void> main() async {
  WidgetsFlutterBinding.ensureInitialized();
  await Firebase.initializeApp();
  await FirebaseAuth.instance.useAuthEmulator('localhost', 9099);
  // ...
}

---

2. Authentication State Management

Use the appropriate stream based on what you need to observe:

Stream	Fires when
authStateChanges()	User signs in or out
idTokenChanges()	ID token changes (including custom claims)
userChanges()	User data changes (e.g., profile updates)

FirebaseAuth.instance
  .authStateChanges()
  .listen((User? user) {
    if (user == null) {
      print('User is currently signed out!');
    } else {
      print('User is signed in!');
    }
  });

• Listen to these streams immediately when the app starts to handle the initial auth state.
• Custom claims are only available after sign-in, re-authentication, token expiration, or manual token refresh.

---

3. Email and Password Authentication

Create a new account:

try {
  final credential = await FirebaseAuth.instance.createUserWithEmailAndPassword(
    email: emailAddress,
    password: password,
  );
} on FirebaseAuthException catch (e) {
  if (e.code == 'weak-password') {
    print('The password provided is too weak.');
  } else if (e.code == 'email-already-in-use') {
    print('The account already exists for that email.');
  }
} catch (e) {
  print(e);
}