🛒 Bringo

Integrations

Firebase OTP (phone auth)

Firebase Phone Authentication is a free alternative to paid SMS gateways. The app gets a verified token from Firebase; your server validates it. No per-SMS cost.

🔥
Use this instead of an SMS gateway for OTP login. It needs your own Firebase project — the same one you'll use for push notifications.

How it works

  1. App requests OTP The Firebase SDK sends the code and handles verification on the device.
  2. App receives a Firebase ID token once the user enters the code.
  3. Server verifies the token against your Firebase project and logs the user in.

Setup

  1. Create a Firebase project (or reuse your push one) — see the Firebase Project guide.
  2. Enable Phone in Firebase → Authentication → Sign-in method.
  3. Register your apps in Firebase (Android package + iOS bundle id) and add the Android SHA-1 / SHA-256 fingerprints (required for phone auth). See the guide.
  4. Put the config files in the apps (google-services.json / GoogleService-Info.plist) — see each app's Firebase page.
  5. In the admin panel, open Admin → SMS Gateway, choose Firebase as the active OTP provider, and enter your Firebase Project ID.
Firebase OTP gateway setting
Admin → SMS Gateway → Firebase.
📱
Phone auth only works in the mobile apps (where the Firebase SDK runs). The apps must be built with your Firebase config. On the website, OTP still uses an SMS gateway.

Test without spending SMS quota

Firebase lets you define fixed test numbers that always accept one fixed code and never send a real message — essential while developing, and the safest way to give an app-store reviewer a working login.

  1. Firebase Console → Authentication → Sign-in method → Phone.
  2. Phone numbers for testing → add a number and the code it should accept.
  3. Sign in with that number in the app — the code works instantly, with no SMS sent.
🧾
Phone auth has a free daily allowance, then bills per verification. Firebase also blocks a project that suddenly spikes, which looks exactly like "OTP stopped working" — check the Firebase usage page before assuming a code bug.

Authorised domains

Web OTP only runs on domains you have allow-listed: Firebase Console → Authentication → Settings → Authorised domains. Add your live domain (and localhost for development). A missing entry is the usual cause of OTP working in the app but failing on the website.

Troubleshooting

"App not authorized"
Missing SHA-1/SHA-256 in Firebase, or the wrong package/bundle id.
Code never arrives
Phone provider not enabled in Firebase, or test-mode quota exceeded.
Works in the app, fails on the website
Your domain is not in Firebase → Authentication → Settings → Authorised domains.
"Too many requests" / temporarily blocked
Firebase rate-limits repeated attempts from one number or device. Wait, or use a configured test number.
Works for you, fails for real users on the Play build
The Play App Signing SHA-1 is not registered in Firebase. Add it to your Android app's fingerprints.
Suddenly stopped for everyone
Check the Firebase usage/billing page — the free phone-auth allowance may be exhausted or the project flagged for a spike.
Server rejects token
The Project ID in admin must match the Firebase project the apps use.
👉
Next: Social Login.