GCP Firebase Developer
Overview
Firebase is Google's app development platform for web and mobile. It provides a unified suite of backend services, SDKs, and tooling. Key products: Firestore (NoSQL real-time database), Firebase Auth (identity), Hosting (global CDN), Cloud Functions for Firebase (server logic), Firebase Storage (file storage), App Check (abuse prevention), Remote Config, Analytics.
Quick Start
# Install Firebase CLI
npm install -g firebase-tools
# Login
firebase login
# Initialize project
firebase init
# Deploy
firebase deploy
Reference Directory
Load only when needed:
| Scenario |
Trigger Keywords |
Reference |
| Firestore data modeling |
collection, document, subcollection, NoSQL schema, query design |
references/firestore.md |
| Authentication |
auth, sign-in, OAuth, email, phone, anonymous, custom claims |
references/auth.md |
| Security Rules |
rules, allow, deny, Firestore rules, Storage rules |
references/security-rules.md |
| Cloud Functions |
functions, trigger, callable, HTTP, Pub/Sub, Firestore trigger |
references/functions.md |
| Hosting |
deploy, hosting, CDN, SPA, redirect, custom domain |
references/hosting.md |
| App Check |
abuse, attestation, reCAPTCHA, DeviceCheck, Play Integrity |
references/app-check.md |
| Emulator Suite |
local testing, emulator, integration test |
references/emulators.md |
| Firebase Extensions |
extension, marketplace, prebuilt |
references/extensions.md |
Core Operating Rules
- Firebase SDKs come in Web (v9 modular), React Native, Flutter, iOS (Swift), and Android (Kotlin/Java) variants. Always confirm the platform before providing SDK code.
- Firestore security rules are the primary access control layer for client-side apps — never assume the app logic is sufficient authorization.
- Use Firebase Emulator Suite for local development and integration testing before deploying to production.
- App Check is mandatory for production apps to prevent unauthorized API access and quota abuse.
- Cloud Functions for Firebase run on Cloud Run (gen2) by default in new projects — prefer gen2 for better performance, concurrency, and VPC connectivity.
- Firebase Auth supports custom claims for role-based access — use claims, not Firestore documents, as the authority for authorization decisions.
- Never expose service account keys or private Firebase config in client-side code. The Firebase client SDK config (apiKey, projectId) is not a secret — it is safe to embed in client bundles.
- Use Firebase Hosting rewrites to serve SPAs and proxy Cloud Functions securely.
Response Shape
Platform/SDK confirmation, Firestore data model, security rules, auth flow, functions, hosting config, App Check setup, test plan with emulators.
Official Docs
Security Notes
Read-only skill. Do not deploy to production, modify Firestore security rules, or change Firebase project settings without explicit approval. Client config (apiKey, projectId) is public — service account keys are private and must never be embedded in client code.
1---2name: gcp-firebase-developer3description: Build, configure, and operate Firebase-powered web and mobile applications — covering Firestore, Firebase Auth, Firebase Hosting, Cloud Functions for Firebase, Firebase Storage, App Check, Firebase Remote Config, and Firebase Analytics. Use when building mobile/web apps with Firebase, setting up authentication flows, designing Firestore data models, deploying Firebase Hosting, or configuring Firebase security rules.4---56# GCP Firebase Developer78## Overview910Firebase is Google's app development platform for web and mobile. It provides a unified suite of backend services, SDKs, and tooling. Key products: Firestore (NoSQL real-time database), Firebase Auth (identity), Hosting (global CDN), Cloud Functions for Firebase (server logic), Firebase Storage (file storage), App Check (abuse prevention), Remote Config, Analytics.1112## Quick Start1314```bash15# Install Firebase CLI16npm install -g firebase-tools1718# Login19firebase login2021# Initialize project22firebase init2324# Deploy25firebase deploy26```2728## Reference Directory2930Load only when needed:3132| Scenario | Trigger Keywords | Reference |33|---|---|---|34| Firestore data modeling | collection, document, subcollection, NoSQL schema, query design | references/firestore.md |35| Authentication | auth, sign-in, OAuth, email, phone, anonymous, custom claims | references/auth.md |36| Security Rules | rules, allow, deny, Firestore rules, Storage rules | references/security-rules.md |37| Cloud Functions | functions, trigger, callable, HTTP, Pub/Sub, Firestore trigger | references/functions.md |38| Hosting | deploy, hosting, CDN, SPA, redirect, custom domain | references/hosting.md |39| App Check | abuse, attestation, reCAPTCHA, DeviceCheck, Play Integrity | references/app-check.md |40| Emulator Suite | local testing, emulator, integration test | references/emulators.md |41| Firebase Extensions | extension, marketplace, prebuilt | references/extensions.md |4243## Core Operating Rules4445- Firebase SDKs come in Web (v9 modular), React Native, Flutter, iOS (Swift), and Android (Kotlin/Java) variants. Always confirm the platform before providing SDK code.46- Firestore security rules are the primary access control layer for client-side apps — never assume the app logic is sufficient authorization.47- Use Firebase Emulator Suite for local development and integration testing before deploying to production.48- App Check is mandatory for production apps to prevent unauthorized API access and quota abuse.49- Cloud Functions for Firebase run on Cloud Run (gen2) by default in new projects — prefer gen2 for better performance, concurrency, and VPC connectivity.50- Firebase Auth supports custom claims for role-based access — use claims, not Firestore documents, as the authority for authorization decisions.51- Never expose service account keys or private Firebase config in client-side code. The Firebase client SDK config (apiKey, projectId) is not a secret — it is safe to embed in client bundles.52- Use Firebase Hosting rewrites to serve SPAs and proxy Cloud Functions securely.5354## Response Shape5556Platform/SDK confirmation, Firestore data model, security rules, auth flow, functions, hosting config, App Check setup, test plan with emulators.5758## Official Docs5960- https://firebase.google.com/docs61- https://firebase.google.com/docs/firestore62- https://firebase.google.com/docs/auth63- https://firebase.google.com/docs/hosting64- https://firebase.google.com/docs/functions65- https://firebase.google.com/docs/app-check6667## Security Notes6869Read-only skill. Do not deploy to production, modify Firestore security rules, or change Firebase project settings without explicit approval. Client config (apiKey, projectId) is public — service account keys are private and must never be embedded in client code.
VincentChuWaiChow