Phone number authentication in Firebase - Deep Dive

Overview - Phone number authentication

What is it?

Phone number authentication is a way to verify a user's identity by sending a code to their mobile phone. The user enters this code to prove they own the phone number. This method uses text messages or calls to deliver the code securely. It helps apps confirm users without needing passwords.

Why it matters

This exists because passwords can be forgotten, stolen, or weak. Phone number authentication makes signing in easier and safer by using something the user has—their phone. Without it, users might struggle with complex passwords or risk account theft. It improves user experience and security in apps.

Where it fits

Before learning this, you should understand basic user authentication and how apps identify users. After this, you can explore multi-factor authentication and advanced security rules in Firebase. This fits into the journey of building secure, user-friendly apps.

Mental Model

Core Idea

Phone number authentication proves who you are by sending a secret code to your phone that only you can receive and enter.

Think of it like...

It's like a club sending a secret handshake through a text message; only the person with the phone can show the handshake to get in.

┌─────────────────────────────┐
│ User enters phone number     │
└──────────────┬──────────────┘
               │
               ▼
┌─────────────────────────────┐
│ System sends code via SMS    │
└──────────────┬──────────────┘
               │
               ▼
┌─────────────────────────────┐
│ User enters received code    │
└──────────────┬──────────────┘
               │
               ▼
┌─────────────────────────────┐
│ System verifies code matches │
└──────────────┬──────────────┘
               │
               ▼
┌─────────────────────────────┐
│ User is authenticated       │
└─────────────────────────────┘

Build-Up - 7 Steps

1

Foundation

Understanding user identity basics

Concept: Learn what it means to identify a user in an app and why it's important.

When you use an app, it needs to know who you are to save your data and preferences. This is called user identification. Traditionally, apps use usernames and passwords to do this. But passwords can be hard to remember and unsafe if stolen.

Result

You understand why apps need to confirm who you are before giving access.

Knowing why identification matters helps you appreciate why better methods like phone authentication exist.

2

Foundation

Basics of phone number verification

Concept: Learn how sending a code to a phone number can prove ownership of that number.

Instead of passwords, apps can send a secret code to your phone via SMS. Only the person with that phone can get the code. When you enter the code in the app, it confirms you own the phone number.

Result

You grasp the simple idea of verifying identity through a phone code.

Understanding this basic step shows how phone authentication replaces passwords with something you physically have.

3

Intermediate

Implementing Firebase phone authentication

🤔Before reading on: do you think Firebase sends the code automatically or requires manual setup? Commit to your answer.

Concept: Learn how Firebase helps apps send verification codes and check them securely.

Firebase provides tools to send SMS codes and verify them. You give Firebase the phone number, it sends the code, and then you check the code the user enters. Firebase handles the hard parts like security and code expiration.

Result

You can set up phone authentication in your app using Firebase's API.

Knowing Firebase manages code sending and verification reduces your workload and improves security.

4

Intermediate

Handling verification callbacks and errors

🤔Before reading on: do you think verification always succeeds on first try? Commit to your answer.

Concept: Learn how to manage success, failure, and edge cases during phone authentication.

Firebase uses callbacks to tell your app when verification succeeds or fails. You must handle cases like wrong codes, expired codes, or too many attempts. This ensures a smooth user experience and prevents abuse.

Result

Your app can respond properly to different verification outcomes.

Handling errors well prevents user frustration and security risks.

5

Intermediate

Using reCAPTCHA for abuse prevention

🤔Before reading on: do you think phone authentication can be used by bots without checks? Commit to your answer.

Concept: Learn how Firebase uses reCAPTCHA to stop automated abuse of phone authentication.

To prevent bots from spamming phone verification, Firebase requires a reCAPTCHA challenge on web apps. This challenge proves the user is human before sending the SMS code. It protects your app and users from fraud.

Result

Your app is safer from automated attacks during phone authentication.

Knowing about reCAPTCHA helps you build secure authentication flows that resist abuse.

6

Advanced

Linking phone authentication with user accounts

🤔Before reading on: do you think phone authentication creates a new user or links to existing accounts automatically? Commit to your answer.

Concept: Learn how to connect phone authentication with existing user profiles or create new ones.

Firebase allows you to link a phone number to an existing user account or create a new user if none exists. This helps users sign in with multiple methods or recover accounts. You control how linking happens in your app logic.

Result

You can manage user identities flexibly using phone authentication.

Understanding linking prevents duplicate accounts and improves user experience.

7

Expert

Security nuances and rate limiting

🤔Before reading on: do you think Firebase automatically limits SMS sends or do you need to configure it? Commit to your answer.

Concept: Explore how Firebase protects against SMS abuse and what developers must do to stay secure.

Firebase enforces limits on how many SMS messages can be sent to a number or IP to prevent abuse. Developers should also implement app-side rate limiting and monitor usage. Misconfigurations can lead to costly SMS bills or security holes.

Result

You understand how to keep phone authentication secure and cost-effective in production.

Knowing these limits helps you design robust authentication systems that scale safely.

Under the Hood

When a user enters their phone number, Firebase generates a unique verification code and sends it via SMS through telecom providers. The code is stored temporarily on Firebase servers with an expiration time. When the user submits the code, Firebase compares it with the stored value. If they match and are valid, Firebase issues a secure token representing the authenticated user. This token is used by the app to grant access.

Why designed this way?

This design leverages existing phone networks for delivery, avoiding the need for passwords. It balances security and usability by using short-lived codes and server-side verification. Alternatives like passwords or hardware tokens were less user-friendly or more costly. Firebase abstracts complexity to help developers implement this easily.

┌───────────────┐       ┌───────────────┐       ┌───────────────┐
│ User enters   │       │ Firebase      │       │ Telecom       │
│ phone number  │──────▶│ generates     │──────▶│ sends SMS     │
└───────────────┘       │ code & stores │       └───────────────┘
                        └──────┬────────┘
                               │
                               ▼
                      ┌─────────────────┐
                      │ User enters code │
                      └────────┬────────┘
                               │
                               ▼
                      ┌─────────────────┐
                      │ Firebase checks │
                      │ code validity   │
                      └────────┬────────┘
                               │
                               ▼
                      ┌─────────────────┐
                      │ Issues auth     │
                      │ token if valid  │
                      └─────────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does phone authentication guarantee 100% security against account theft? Commit yes or no.

Common Belief: Phone number authentication is completely secure and cannot be hacked.

Reality: While it improves security, phone authentication can be vulnerable to SIM swapping or interception attacks.

Why it matters: Believing it is foolproof may lead to ignoring additional security layers, risking account takeover.

Quick: Do you think Firebase automatically creates user accounts for every phone number verified? Commit yes or no.

Common Belief: Every phone number verification automatically creates a new user account.

Reality: Firebase only creates a user account if you explicitly sign in or link the phone number; verification alone doesn't create users.

Why it matters: Assuming automatic user creation can cause confusion and unexpected app behavior.

Quick: Can phone authentication be used without any user interaction on web apps? Commit yes or no.

Common Belief: Phone authentication can silently verify users without any challenges or user input.

Reality: On web apps, Firebase requires reCAPTCHA verification to prevent abuse, so user interaction is needed.

Why it matters: Ignoring this leads to broken flows or security vulnerabilities in web implementations.

Quick: Does sending many SMS codes cost nothing to developers? Commit yes or no.

Common Belief: Sending SMS verification codes is free and unlimited.

Reality: SMS messages cost money and Firebase enforces limits to prevent excessive charges.

Why it matters: Not understanding costs can lead to unexpected bills and service disruptions.

Expert Zone

1

Firebase uses invisible reCAPTCHA on mobile apps to reduce user friction while still preventing abuse.

2

Linking phone authentication with other sign-in methods requires careful handling to avoid account hijacking.

3

Rate limits vary by region and phone carrier, so global apps must monitor usage closely.

When NOT to use

Phone number authentication is not ideal when users lack reliable phone access or when higher security is needed, such as in banking apps. Alternatives include email/password, hardware tokens, or biometric authentication.

Production Patterns

In production, apps combine phone authentication with multi-factor authentication, use custom user claims for roles, and implement monitoring to detect suspicious verification attempts.

Connections

Multi-factor authentication

Phone authentication is often one factor combined with others for stronger security.

Understanding phone authentication helps grasp how multiple proofs of identity work together to protect accounts.

Telecommunications networks

Phone authentication relies on telecom infrastructure to deliver SMS messages securely and reliably.

Knowing telecom basics explains why SMS delivery can sometimes be delayed or fail.

Human verification challenges (CAPTCHA)

Phone authentication uses CAPTCHA to distinguish humans from bots during verification.

Recognizing this link shows how security layers combine to prevent automated abuse.

Common Pitfalls

#1 Not handling verification failures properly

Wrong approach:

firebase.auth().signInWithPhoneNumber(phoneNumber)
.then(confirmationResult => {
// No error handling
});

Correct approach:

firebase.auth().signInWithPhoneNumber(phoneNumber)
.then(confirmationResult => {
// handle success
})
.catch(error => {
// handle errors like invalid number or quota exceeded
});

Root cause:

Ignoring error handling leads to crashes or poor user experience when verification fails.

#2 Skipping reCAPTCHA setup on web apps

Wrong approach:

firebase.auth().signInWithPhoneNumber(phoneNumber); // no reCAPTCHA verifier

Correct approach:

const recaptchaVerifier = new firebase.auth.RecaptchaVerifier('recaptcha-container');
firebase.auth().signInWithPhoneNumber(phoneNumber, recaptchaVerifier);

Root cause:

Not implementing reCAPTCHA causes Firebase to block SMS sending for security reasons.

#3 Assuming phone authentication replaces all security needs

Wrong approach:

// Using phone auth as sole security without monitoring or additional checks

Correct approach:

// Combine phone auth with monitoring, rate limiting, and optionally multi-factor auth

Root cause:

Overreliance on phone auth can expose apps to SIM swap attacks or abuse.

Key Takeaways

Phone number authentication uses SMS codes to verify user identity without passwords.

Firebase simplifies sending and verifying codes but requires proper error and security handling.

reCAPTCHA protects phone authentication from automated abuse, especially on web apps.

Linking phone authentication with user accounts prevents duplicates and improves user experience.

Understanding limits and risks helps build secure, scalable authentication systems.

Practice

1. What is the main purpose of phone number authentication in Firebase?

easy

A. To sign in users using SMS codes without passwords

B. To store phone numbers in the database

C. To send marketing messages to users

D. To verify email addresses

Solution

1. Step 1: Understand and identify the main purpose of phone number authentication

   It allows users to sign in by receiving a code on their phone via SMS instead of using a password. The main goal is to authenticate users securely and easily using their phone number and SMS code.

2. Final Answer:

   To sign in users using SMS codes without passwords -> Option A

3. Quick Check:

   Phone number authentication = SMS sign-in [OK]

Hint: Phone auth uses SMS codes to sign in, not emails [OK]

Common Mistakes:

• Confusing phone auth with email verification
• Thinking it stores phone numbers only
• Assuming it sends marketing SMS

2. Which Firebase method is used to start phone number authentication by sending an SMS code?

easy

A. signInWithEmailAndPassword()

B. signInWithPhoneNumber()

C. sendPasswordResetEmail()

D. verifyPhoneNumber()

Solution

1. Step 1: Identify the method for phone auth SMS sending and exclude unrelated methods

   Firebase provides signInWithPhoneNumber() to send the SMS code to the user. signInWithEmailAndPassword() is for email login, sendPasswordResetEmail() is for password reset, and verifyPhoneNumber() is not a Firebase client method.

2. Final Answer:

   signInWithPhoneNumber() -> Option B

3. Quick Check:

   Send SMS code = signInWithPhoneNumber() [OK]

Hint: Phone auth starts with signInWithPhoneNumber() [OK]

Common Mistakes:

• Using email sign-in methods for phone auth
• Confusing password reset with phone auth
• Assuming verifyPhoneNumber() is a Firebase method

3. What will happen if you try to sign in with phone number authentication without setting up reCAPTCHA verifier in Firebase web?

medium

A. The phone number will be stored but no SMS sent

B. The SMS code will be sent without any issues

C. The user will be signed in automatically

D. Firebase will throw an error requiring reCAPTCHA verification

Solution

1. Step 1: Understand reCAPTCHA role and predict behavior without it in Firebase phone auth

   Firebase requires reCAPTCHA on web to prevent abuse and verify the user is human before sending SMS. If reCAPTCHA is not set up, Firebase will block the SMS sending and throw an error demanding reCAPTCHA verification.

2. Final Answer:

   Firebase will throw an error requiring reCAPTCHA verification -> Option D

3. Quick Check:

   Missing reCAPTCHA = error thrown [OK]

Hint: Web phone auth needs reCAPTCHA or it errors [OK]

Common Mistakes:

• Assuming SMS sends without reCAPTCHA
• Thinking user signs in automatically
• Believing phone number stores without SMS

4. Given this code snippet, what is the error?

const confirmationResult = await signInWithPhoneNumber(auth, phoneNumber, appVerifier);
const userCredential = await confirmationResult.confirm(code);

medium

A. phoneNumber should be an email string

B. Using confirm() instead of verify() method

C. Missing reCAPTCHA verifier initialization

D. code variable should be a number, not string

Solution

1. Step 1: Check parameters and identify common mistake in signInWithPhoneNumber code

   The third parameter must be a valid reCAPTCHA verifier instance (appVerifier) initialized properly. If appVerifier is not initialized or missing, the code will fail even if confirm() is called correctly.

2. Final Answer:

   Missing reCAPTCHA verifier initialization -> Option C

3. Quick Check:

   Missing appVerifier init = error [OK]

Hint: Always initialize reCAPTCHA verifier before signInWithPhoneNumber() [OK]

Common Mistakes:

• Confusing confirm() with verify() method
• Passing email instead of phone number
• Assuming code must be number type

5. You want to implement phone number authentication in a React app using Firebase. Which sequence correctly describes the steps to sign in a user?

hard

A. Initialize reCAPTCHA verifier -> call signInWithPhoneNumber() -> send SMS -> confirm code -> sign in user

B. Call signInWithPhoneNumber() -> confirm code -> initialize reCAPTCHA verifier -> sign in user

C. Confirm code -> initialize reCAPTCHA verifier -> call signInWithPhoneNumber() -> sign in user

D. Sign in user -> initialize reCAPTCHA verifier -> call signInWithPhoneNumber() -> confirm code

Solution

1. Step 1: Outline the correct sequence for implementing phone auth

   Initialize reCAPTCHA verifier first to prevent abuse and required before sending SMS. Call signInWithPhoneNumber() next to send the code to the user's phone. Confirm the code received by user using confirmationResult.confirm(code) to verify and sign in the user.

2. Final Answer:

   Initialize reCAPTCHA verifier -> call signInWithPhoneNumber() -> send SMS -> confirm code -> sign in user -> Option A

3. Quick Check:

   reCAPTCHA -> send SMS -> confirm code = correct flow [OK]

Hint: Always start with reCAPTCHA, then send SMS, then confirm code [OK]

Common Mistakes:

• Calling signInWithPhoneNumber before reCAPTCHA setup
• Confirming code before SMS sent
• Trying to sign in before confirmation