firebase

flutterfire#18872 割と困っているというか、ワークアラウンドするしかない状況が続いててうーんとなるやつ。

Firebase iOS Push Notifications: APNs Key and SDK Setup Firebase Cloud Messaging (FCM) can deliver push notifications to iPhones, but it doesn't talk to iOS devices directly — it goes through Apple Push Notification service (APNs). Most “Firebase iOS push isn't working” problems come from the Apple side of that handshake. This guide sets up both sides in order. How Firebase push works on iOS Your app registers with APNs and receives an APNs device token. The Firebase iOS SDK maps that token to an FCM registration token, which is the one your server uses. When you send a message, FCM authenticates with APNs using the key you uploaded, and APNs delivers it to the device. If Firebase can't authenticate with APNs, nothing arrives — even though everything looks fine in your app. Prerequisites - A paid Apple Developer Program membership — push needs one. - A Firebase project with your iOS app added, and its GoogleService-Info.plist. - Xcode and a physical iPhone or iPad. The Simulator isn't a reliable test for remote push. 1. Create an APNs authentication key 1. In the Apple Developer portal, open Certificates, Identifiers & Profiles → Keys and create a new key. 2. Enable Apple Push Notifications service (APNs) for the key, then register it. 3. Download the .p8 file and note its Key ID. Apple lets you download it only once, so store it somewhere safe. 4. Note your Team ID, shown in your developer account's membership details. An authentication key doesn't expire like a push certificate, and one key works for all your apps — which is why it's the recommended option over the older .p12 certificates. 2. Upload the key to Firebase In the Firebase console, open Project settings → Cloud Messaging. Under your Apple app, upload the .p8 key and enter the Key ID and Team ID. Firebase uses this key to authenticate with APNs on your behalf. 3. Add the Firebase iOS SDK In Xcode, choose File → Add Package Dependencies and add https://github.com/firebase/firebase-ios-sdk. Select the FirebaseMessaging product. Then drag GoogleService-Info.plist into your app target. 4. Enable capabilities Select your app target, open Signing & Capabilities, and add Push Notifications. Add Background Modes and check Remote notifications if you send silent or data-only pushes. 5. Request permission and get the FCM token Configure Firebase at launch, ask the user for permission, register for remote notifications, and listen for the FCM token: import UIKit import FirebaseCore import FirebaseMessaging import UserNotifications @main class AppDelegate: UIResponder, UIApplicationDelegate, UNUserNotificationCenterDelegate, MessagingDelegate { func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?) -> Bool { FirebaseApp.configure() Messaging.messaging().delegate = self UNUserNotificationCenter.current().delegate = self UNUserNotificationCenter.current().requestAuthorization( options: [.alert, .badge, .sound] ) { granted, error in // Respect the user's choice; you can ask again later from settings } application.registerForRemoteNotifications() return true } // Called with a new or refreshed FCM registration token func messaging(_ messaging: Messaging, didReceiveRegistrationToken fcmToken: String?) { guard let fcmToken else { return } // Send this token to your push server print("FCM token: \(fcmToken)") } // Show notifications while the app is in the foreground func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification) async -> UNNotificationPresentationOptions { [.banner, .sound, .badge] } } By default the Firebase SDK uses method swizzling to pass the APNs token to FCM automatically. If you set FirebaseAppDelegateProxyEnabled to NO in your Info.plist, you must pass the APNs token yourself by setting Messaging.messaging().apnsToken in didRegisterForRemoteNotificationsWithDeviceToken. 6. Send a test notification Run the app on a physical device, accept the permission prompt, and copy the FCM token from the console. In the Firebase console, open Messaging, create a notification, and use Send test message with that token. Test with the app in the foreground, in the background, and fully closed. Why Firebase iOS push isn't working - No APNs key in Firebase: the token is generated, but nothing is delivered. Check Project settings → Cloud Messaging. - Wrong Team ID or Key ID: APNs rejects Firebase's requests. Re-enter both from your Apple developer account. - Bundle ID mismatch: the iOS app in Firebase must use exactly the same bundle ID as your Xcode target. - Push Notifications capability missing: the app never receives an APNs token, so no FCM token works. - Swizzling disabled without passing the APNs token: FCM has no APNs token to map. - Permission denied: the user declined the prompt; notifications are delivered silently or not shown. Using React Native or Flutter? The Apple-side steps — APNs key, Firebase upload, and capabilities — are the same. The notifySphere SDKs handle the token and permission code for you: see the React Native guide and the Flutter guide. notifySphere runs on Firebase Cloud Messaging, so once your Firebase project can reach APNs, uploading its service account lets you send segmented iOS, Android, and web campaigns from one dashboard. --- Originally published on the notifySphere blog. notifySphere is push notifications, WhatsApp Business API, deep linking, and in-app support in one SDK — free up to 1,000 users.

Swift Package ManagerをTuist経由で導入し、CocoaPodsと併用しながら移行する 株式会社DIGITALIOで開発しているiOS版 ECナビアンケートアプリ は、依存関係の管理にCocoaPodsを使っていました。本記事では、依存関係の管理をCocoaPodsからSPM（Swift Package Manager）に移行した経緯と手法について書きます。 TL;DR 想定読者: Tuistでプロジェクトを生成していて、CocoaPodsからSPMへの移行を検討している方 依存関係の宣言をTuistの定義ファイルに集約でき、移行は「定義ファイルへの追加と Podfile からの削除」の繰り返しで済んだ 広告メディエーションのSDK本体とアダプターだけCocoaPodsに残し、SPMと併用で運用できている 前提 本記事は、TuistでXcodeプロジェクトを生成している環境を前提にしています。前回の記事では、 project.pbxproj のコンフリクトをなくすためにTuistを導入し、ビルドターゲットを Project.swift に定義して tuist generate で生成する運用に切り替えました。 zenn.dev 生成物はGit管理から除外しているため、ブランチの切り替えやファイルの追加のたびに make sync-develop でプロジェクトを再生成しています。 SPM移行のきっかけ きっかけはFirebaseから届いたメールでした。Firebase SDKは2026年10月にCocoaPodsへの新バージョン公開を停止し、以降はpodspecからのインストールが公式サポートの対象外となり、SPMまたは手動インストールへの移行が案内される、という内容です。手順は公式の移行ガイドにまとまっています。 firebase.google.com これはFirebase固有の話ではありません。CocoaPods Trunk自体も、2026年12月2日にread-onlyモードへ移行することが以前から告知されており、同じ流れにあります1。 blog.cocoapods.org CocoaPods経由でFirebaseを使い続けても公開済みのバージョンは動きますが、新機能やバグ修正は受け取れなくなります2。この告知を機に、依存関係管理をCocoaPodsからSPMへ移行することにしました。 依存関係を種類ごとに分けて移行 まず、Tuist経由でSPMを利用するために、依存関係を記述する Tuist/Package.swift を作成しました。 // swift-tools-version: 5.9 import PackageDescription #if TUIST import ProjectDescription let packageSettings = PackageSettings( productTypes: [:] ) #endif let package = Package( name: "ECNaviEnqueteApp", dependencies: [ // ここに追記していく ] ) 次に、 Podfile に書かれていた依存関係を、ネットワーク、認証、UI、その他の依存関係といった種類ごとに分類して順番に移行しました。種類ごとに分けたのは、1つのPRで動作確認すべき範囲を絞り、問題が起きたときに原因を特定しやすくするためです。 どのタスクも手順自体は共通で、次の3ステップです。実際にFirebaseを移行した例で見てみます。 Tuist/Package.swift に対象の依存関係を追加する // ... - .package( - url: "firebase/firebase-ios-sdk", - exact: "12.14.0" - ), .package( url: "kaishin/Gifu", exact: "3.4.0" ), Project.swift で .external(name:) として依存関係を宣言する // ... - .external(name: "FirebaseAnalytics"), - .external(name: "FirebaseMessaging"), - .external(name: "FirebaseRemoteConfig"), - .external(name: "FirebaseInAppMessaging-Beta"), - .external(name: "FirebaseCrashlytics"), .external(name: "Gifu"), CocoaPodsではsubspec（ Firebase/InAppMessaging など）で選んでいた機能が、SPMでは1つのパッケージが公開する複数のプロダクトになります。 .external(name:) にはSPM側のプロダクト名を指定するため、Pod側の名前と異なるものもあります。 Podfile から該当のPodを削除する - # Firebase - pod 'Firebase/Core', '>10.22.0' - pod 'Firebase/Analytics' - pod 'Firebase/Messaging' - pod 'Firebase/RemoteConfig' - pod 'Firebase/InAppMessaging' - pod 'Firebase/Crashlytics' - ... 依存関係の解決はTuistが担うようになるため、 Makefile に tuist install を追加しました。依存関係の解決はプロジェクト生成時に済んでいる必要があるため、 tuist generate の前に置いています。 sync-develop: cp ECNaviEnqueteApp/Resource/GoogleService-Info-Develop.plist ECNaviEnqueteApp/Resource/GoogleService-Info.plist - tuist install tuist generate --no-open bundle exec pod install 変更を反映するには make sync-develop を実行します。次の順にコマンドが動き、SPMとCocoaPodsのロックファイルも更新されます。 移行でつまずいた点と残った課題 SPMへの移行では、単に依存関係の宣言先を変えるだけでなく、依存関係の利用方法によって個別対応が必要になったものもありました。 スクリプトのパスが変わった 移行した依存関係の1つであるFirebase Crashlyticsは、ビルド後にdSYMをアップロードするビルドスクリプト（Run Script）を実行します。 このスクリプトは、CocoaPodsでは Pods/ 配下にありましたが、SPMでは取得したパッケージのディレクトリ内に移ります。Tuistはこれを Tuist/.build/checkouts/ 配下に置くため、移行のタイミングで定義ファイルのスクリプトが参照するパスも変更しました。 - "${PODS_ROOT}/FirebaseCrashlytics/run" - "${SRCROOT}/Tuist/.build/checkouts/firebase-ios-sdk/Crashlytics/run" コードの追加対応を伴ったもの 依存関係によっては、コードの追加が必要になった箇所もありました。例えば、ネットワークレイヤーを抽象化するMoyaをCocoaPodsからSPMに移行してビルドし直すと、次のようなエラーが出ました。 FooBarClass.swift:xx:yy Cannot find 'UIDevice' in scope 原因は、CocoaPodsが各Podに生成するumbrella header（ Moya-umbrella.h ）とmodulemapでした。新規のプロジェクトで Podfile に use_frameworks! を指定してMoyaを導入すると、次のようなファイルが生成されます（抜粋）。 // Moya-umbrella.h #ifdef OBJC #import <UIKit/UIKit.h> #else // ... // Moya.modulemap framework module Moya { umbrella header "Moya-umbrella.h" export * module * { export * } } umbrella headerがUIKitを、UIKitがFoundationを読み込み、modulemapの export * がそれらを再エクスポートします。そのため、 import Moya と書くだけでFoundationとUIKit双方のシンボルが使えていました。 import Moya │ ├─ CocoaPods時代: FoundationもUIKitもついてきた ٩(ˊᗜˋ*)و │ └─ SPM: Moyaしか来ない (；ﾟДﾟ) 「UIDeviceって誰…？」 SPM経由ではこの経路が失われます。その結果、実際にはFoundationやUIKitのAPIを直接使っているのに、Moyaのimportだけに依存していた数ファイルがコンパイルエラーになりました。 対象ファイルに import Foundation / import UIKit を追加して解決しました。暗黙の再エクスポートは他のPodでも起きうるため、移行対象を分けておくと、コンパイルエラーの原因を直前に移したPodに絞り込めます。 一部の依存関係はSPM対応待ち すべての依存関係をSPMへ移行できたわけではありません。広告配信のために利用している広告メディエーションでは、SDK本体こそSPM対応が完了していました。しかし、私たちが利用している複数の広告ネットワークに対応するアダプターは、CocoaPods版のSDK本体に依存する構成でした。 アダプターのPodはSDK本体のPodを依存関係として引き込むため、SDK本体だけSPMへ移すと、同じSDKがCocoaPods版とSPM版の2系統で宣言された状態になります。検証したところ、ビルドは通りました。 ただし版が異なる場合、どちらが採用されるかを示す警告は出ず、手元の検証ではSPM版が採用されました3。意図しない版が混ざる状態を避けるため、アダプターのSPM対応が済むまでは、SDK本体もCocoaPodsに残すこととしました。 開発ツールはmiseで管理 本アプリでは、Swiftの静的解析ツールであるSwiftLintと、アプリで使用しているオープンソースライブラリのライセンス一覧を自動生成するLicensePlistを使用しています。 これらは、アプリ本体にリンクされるわけではない開発ツールです。CocoaPods管理から切り出すにあたって、前回Tuistのバージョン固定用に導入したmiseへ寄せ、ツールのバージョン管理を一元化しました。 [tools] - license-plist = "3.27.9" - swiftlint = "0.63.3" tuist = "4.195.9" これらを呼ぶスクリプトは、 Pods/ 配下のパスからmiseのshimを指すように変更しました。 - "${PODS_ROOT}/SwiftLint/swiftlint" - "${MISE_DATA_DIR:-${HOME}/.local/share/mise}/shims/swiftlint" なお、LicensePlistは、SPM管理のパッケージを検出するための設定が必要でした。LicensePlistは、SPMのパッケージを Package.resolved から探します。しかし本アプリでは、Tuistが Tuist/Package.resolved を管理しており、LicensePlistの既定の探索先には存在せず、アプリ内のライセンス一覧に含まれませんでした4。 そこで、 license_plist.yml の packagePaths に Tuist/Package.swift を指定すると、同じディレクトリの Package.resolved が参照されるようになりました。 - options: - packagePaths: - - Tuist/Package.swift 移行後の状況 一連の移行の結果、依存関係の状態は次のようになりました。 状態 対象 SPMへ移行済み ネットワーク、認証、UI、その他の依存関係 miseへ移行済み SwiftLint、LicensePlist CocoaPodsのまま維持 広告メディエーションSDK本体とアダプター Podfile に書かれていたSDK本体とアダプター以外の21件のPod宣言は、すべてなくなりました。残りの依存関係は、提供元のリリースノートでSPM対応の有無を確認しながら追従していきます。 まとめ Tuistの .external(name:) で依存関係を宣言できるため、移行作業の多くは定義ファイルへの追加と Podfile からの削除という小さな差分の繰り返しになりました。種類ごとに分けて、独立してレビュー・マージできる単位で進めたことで、各PRも小さく保てました。同様の移行を控えている場合は、以下の手順で実施するとスムーズに移行が進められると思います。 前回の記事 を参考にXcodeプロジェクトの管理方式を決める。 依存関係ごとに、SPMへの対応状況を調べる。 種類ごとに分け、動作確認しやすい粒度で順番に移行する。 CocoaPodsに残る依存関係は、12月2日以降は新バージョンがTrunkに公開されなくなります。提供元のSPM対応状況を確認し、未対応のものはアダプターごと移行できる時期を見極める必要があります。 脚注 read-only化後も既存のPodは取得できるが、Trunkに新しいPodやバージョンは公開できなくなる。独自のspecリポジトリで配布されているPodは影響を受けない。 ↩︎ Firebase公式の移行ガイドによれば、CocoaPodsで最後に公開されるメジャーバージョンは12とされている。 ↩︎ CocoaPodsとSPMのバージョンを入れ替えて2通りで検証した。いずれも、ビルドしたバイナリに含まれていたのはSPM版で、新旧は関係なかった。どのパターンでも同じかまでは検証できていない。 ↩︎ 既定の探索先は、プロジェクトルートの Package.swift と、 *.xcodeproj および *.xcworkspace 配下の xcshareddata/swiftpm/Package.resolved である。詳細は LicensePlistのREADME を参照。 ↩︎

Extracting structured data from PDFs using Gemini 2.0 and Genkit in Firebase: Web Architecture & Implementation Guide Original: codingcat.dev Building AI features in TypeScript or Go quickly turns into spaghetti when you try to bolt structured output validation, tool calling, and OpenTelemetry tracing onto raw model API calls. Following the announcement of Extracting structured data from PDFs using Gemini 2.0 and Genkit by Peter Friese on the Official Firebase Blog (2025-02-20), here is our hands-on CodingCat.dev breakdown of what actually shipped, how it works under the hood, and how we wire it into production TypeScript, Next.js, Astro, SvelteKit, React, and Angular applications. Last week, Google released Gemini 2.0, and after reading this blog post about parsing PDFs using Gemini 2.0, I decided to rebuild the sample using Genkit. The Mental Model: Why Extracting structured data from PDFs using Gemini 2.0 and Genkit Matters for Web Devs As a Google Developer Expert (GDE) for Firebase and Senior Solutions Engineer at CodingCat.dev, I evaluate every Firebase update through one lens: does it reduce boilerplate while keeping our runtime security and cloud bills predictable? Firebase Genkit gives full-stack engineers strongly typed flows, dotprompt templates, local developer UI trace inspection, and production observability wired directly into Google Cloud and Firebase. > AJ Pro-Tip from Alex: Always wrap your Genkit flows with explicit Zod input/output schemas and enforce Firebase App Check attestation on callable endpoints so bots cannot rack up unauthenticated token spend. How It Works: Technical Breakdown & Implementation For those who are unfamiliar, Genkit is an AI integration framework that makes implementing AI features for your apps easier. In this blog post, I am going to focus on Genkit for Node.js, but the team is also working on building support for Go (available in alpha) and Python (under development). This means you can use Genkit on any runtime that supports one of those three languages. The sample app I’m discussing in this blog post is a simple command-line utility that you can run on macOS or any other platform that supports Node.js, but you can also use Genkit on the backend, for example in Cloud Functions for Firebase, Cloud Run, or any other environment that supports Node.js. Setup Before you can use Gemini 2.0 Flash in Genkit, you need to install and add Genkit and the Google AI SDK plugin for Genkit. You can then instantiate Genkit and define a default model. This model will then be used in all subsequent calls you make via the ai instance. import import // instantiate Genkit const plugins: [ model: gemini20Flash, }); For a detailed walkthrough of the setup process, check out this video: Extracting structured data In this first example, let’s look at how you can use Gemini 2.0 Flash and Genkit to extract structured data from PDFs. Let’s imagine you’ve received a PDF with an invoice. To further process the invoice, you need to extract the invoice number, date, all the line items (including description, amount, and their individual price), as well as the gross price of the invoice. Thanks to Gemini’s vision capabilities, we can let it handle the OCR for us. The following code snippet shows how to call any LLM via Genkit’s unified generation API, and pass a multimodal prompt (including a URL to the PDF file we want to analyse as well as an instruction). export const prompt: [ { media: { url } }, { text: ] }); return } If you’d call this method now for example by passing this URL (which points to an invoice), you’d get the following result: [ { 'Invoice no': ' 'Date of issue': ' Seller: { Name: 'Williams LLC', Address: ' Tax Id': ' IBAN: 'GB }, Client: { Name: 'Hernandez-Anderson', Address: ' 'Tax Id': ' }, Items: [ [Object], [Object], [Object], [Object], [Object], [Object], [Object] ], Summary: { 'VAT [%]': ' 'Net worth': ' VAT: ' 'Gross worth': ' Total: '$ 'Total VAT': '$ 'Total Gross worth': '$ } } ] Which is pretty impressive - after all, the model was able to correctly extract all information. However, this might not be in the format you need this in. This is where Genkit’s support for structured output comes in handy. You can define a schema for your data using Zod, like this: export const prompt: [ { media: { url } }, { text: ] }); return } Then, pass the schema to Genkit’s generate call to enforce this schema. export const prompt: [ { media: { url } }, { text: ], }); return } And now, calling the function with the same PDF file will yield the following result: { date: ' invoiceNumber: ' items: [ { description: 'Lilly Pulitzer dress Size grossWorth: quantity: }, { description: 'New ERIN Erin Fertherston Straight Dress White Sequence Lining Sleeveless SZ grossWorth: quantity: }, { description: 'Sequence dress Size Small', grossWorth: quantity: }, { description: 'fire los angeles dress Medium', grossWorth: quantity: }, { description: grossWorth: quantity: }, { description: 'Lularoe Nicole Dress Size Small Light Solid Grey/ White Ringer Tee Trim', grossWorth: quantity: }, { description: 'J.Crew Collection Black & White sweater Dress sz S', grossWorth: quantity: } ], totalGrossWorth: } Since this adheres to the schema we provided, it will be much easier to process. Gemini 2.0 Flash supports structured output, but even if you’re using an LLM that doesn’t support natively structured output, Genkit can help by augmenting the prompt and coercing the returned data for you. What’s really amazing about this: you won’t have to change your code, thanks to Genkit’s unified generation API (check out this thread on Bluesky in which I demonstrate this). Parsing hand-written form input I mentioned Gemini’s OCR capabilities, so let’s try extracting the hand-written entries in the following PDF: One way to achieve this would be to define a new schema and then call Genkit’s generate method using this new schema. But there is a more flexible way to do this. It turns out that the actual code for calling Gemini to extract data from a PDF is always the same - only the output format (and potentially the instructions) change for each type of PDF we want to analyse. So why not make this a bit more generic? Genkit provides a way to extract prompts into external files, using the Dotprompt library. This allows you to keep your code free from any prompt, making it easier to change the prompt independently of the code. --- model input schema pdfUrl default pdfUrl output schema formNumber startDate beginningOfYear endOfYear name address phoneNumber ein --- Extract the hand-written form data. {{media url This prompt file defines the model Genkit should use (Gemini 2.0 Flash), as well as the prompt itself. But it also specifies the input and output schemas for the prompt. For example, under input/schema, we define an input parameter named pdfUrl of type string, which can then be used in the prompt to pass the URL. Likewise, under output/schema, we define all the keys we want to extract from the PDF file, including their types. Note that the descriptions of the keys do not just serve the purpose of documentation - Genkit will use them in the prompt to specifically tell the model how to find the data for the respective keys. To load a prompt from a file, use ai.prompt(filename). This has a beneficial side effect: we can now create.prompt files for all the different types of data we want to extract from PDF files, and just pass the filename to the extract function: export const const return } Instead of using ai.generate() to call the LLM, you can execute a prompt by caling the prompt itself, and passing the required parameters. Calling this method using extract("form", "https://storage.googleapis.com/generativeai-downloads/data/pdf_structured_outputs/handwriting_form.pdf") will yield the following result: { address: ' beginningOfYear: ein: ' endOfYear: formNumber: 'CA name: 'Annual Return Plan', phoneNumber: ' startDate: ' } Which - if you ask me - is mind-boggling. Where to go from here To learn more about Genkit, check out the documentation. Also, feel free to drop by my weekly livestreams - I’m currently working on implementing a Second Brain app, and I’m using Genkit for some of the AI-powered features. If you’d like to try out the sample app, the source code is available on GitHub. Production Web Architecture & Security Checklist Whether we are deploying on Firebase App Hosting, Cloudflare Workers, or Vercel, shipping AI features to production requires defense-in-depth across three layers: - Enforce Firebase App Check & Attestation: **Protect your web endpoints, Cloud Functions, Data Connect GraphQL resolvers, and Firebase AI Logic calls against unauthorized replay or billing abuse using Firebase App Check with reCAPTCHA Enterprise**. - **Validate Locally with the Firebase Emulator Suite: **Run deterministic integration tests against local Firestore, Auth, Functions, and Data Connect PostgreSQL emulators before promoting schema or rule changes to production. - **Keep Server & Client Boundaries Type-Safe: **Use the modular Firebase Web SDK and generated TypeScript bindings so SSR frameworks like Next.js, Astro, SvelteKit, and Angular serialize state cleanly without hydration flickers. Conclusion Accelerate your full-stack web and AI development by pairing Extracting structured data from PDFs using Gemini 2.0 and Genkit with strict Security Rules, Firebase App Check, and local emulator testing. Come tell us on X (@CodingCatDev) and LinkedIn (CodingCat.dev) how you are using Firebase in your stack, and subscribe to the CodingCat.dev YouTube Channel so you don't miss what we build next! Watch Our Related Firebase Video Tutorial on YouTube Want to see how we architect and debug Firebase web applications live? Watch our related CodingCat.dev session Firebase SQL with Data Connect below, and make sure to Subscribe to CodingCat.dev on YouTube for weekly full-stack web and AI deep dives: {% youtube N25khadfUag %} Resources, Official Docs & Related CodingCat.dev Guides - Primary Release Source: **Extracting structured data from PDFs using Gemini 2.0 and Genkit on the Official Firebase Blog (published 2025-02-20 by Peter Friese) - **Official Firebase Documentation: **Firebase Developer Docs & Web SDK Reference - **Related on CodingCat.dev: Announcing Firebase Genkit 1.0 for Node.js - Related on CodingCat.dev: Firebase + Gemini Code Assist - Related on CodingCat.dev: Firebase SQL with Data Connect - Related on CodingCat.dev: Build a Custom No-Code App in 90 Minutes Frequently Asked Questions (FAQ) What are the key capabilities introduced in Extracting structured data from PDFs using Gemini 2.0 and Genkit? Extracting structured data from PDFs using Gemini 2.0 and Genkit (announced 2025-02-20 by the Firebase team) enhances the platform for Firebase, Google Cloud, Web Dev, AI, TypeScript, Serverless workloads. Last week, Google released Gemini 2.0, and after reading this blog post about parsing PDFs using Gemini 2.0, I decided to rebuild the sample using Genkit. Developers can review the primary announcement on the Firebase Blog alongside our implementation patterns and production checklist above. How do web developers use Extracting structured data from PDFs using Gemini 2.0 and Genkit with Next.js, SvelteKit, React, or Angular? Web developers can integrate these features using the modular Firebase JavaScript/TypeScript SDK, Firebase Data Connect web bindings, and Firebase App Hosting. Always pair client-side SDK initialization with Firebase App Check and strict Security Rules, and test locally with the Firebase Local Emulator Suite before deploying. Where can I watch video tutorials on Firebase Web and AI development? You can watch our hands-on Firebase video walkthroughs on the CodingCat.dev YouTube Channel, including Firebase SQL with Data Connect, and follow us on X (@CodingCatDev) for weekly full-stack tutorials.

February Update: What's New in Data Connect in Firebase: Web Architecture & Implementation Guide Original: codingcat.dev For years, choosing Firebase meant trading away relational SQL joins, strict foreign keys, and pgvector similarity search in favor of NoSQL document denormalization. Following the announcement of February Update: What's New in Data Connect by Cynthia Wang on the Official Firebase Blog (2025-02-26), here is our hands-on CodingCat.dev breakdown of what actually shipped, how it works under the hood, and how we wire it into production TypeScript, Next.js, Astro, SvelteKit, React, and Angular applications. Note: Firebase Data Connect has been renamed to SQL Connect. Learn more in the SQL Connect announcement. The Mental Model: Why February Update: What's New in Data Connect Matters for Web Devs As a Google Developer Expert (GDE) for Firebase and Senior Solutions Engineer at CodingCat.dev, I evaluate every Firebase update through one lens: does it reduce boilerplate while keeping our runtime security and cloud bills predictable? Firebase Data Connect bridges that gap by pairing a managed Google Cloud SQL for PostgreSQL instance with a declarative GraphQL schema compiler that automatically generates type-safe TypeScript, React, and Angular SDKs alongside server-enforced @auth directives. > AJ Pro-Tip from Alex: Keep your authorization logic inside your Data Connect GraphQL operations using @auth(level: USER) and server-evaluated expressions like auth.uid and request.time rather than trusting client-supplied user IDs in query variables. How It Works: Technical Breakdown & Implementation New year, new features! Built on CloudSQL, Firebase Data Connect is our backend-as-a-service for Postgres. It’s a high-performance, scalable, and secure way to work with relational data using GraphQL. Since our previous update in ‘24, we’ve been hot at work to make Firebase Data Connect better to use, here’s a peek at what’s new. What’s New? Using React? Now you can generate React SDKs for your projects, with bindings powered by TanStack Query, to integrate your GraphQL operations into your React based apps. More frameworks are also in the works, so keep an eye out! Enable generating React Hooks in connector.yaml: generate: javascriptSdk: react: true outputDir: "../movies-generated" package: "@movie-app/movies" packageJsonDir: "../../" import function const if return } if return } return < {data. < ))} </ ); } Learn more about React support in the documentation. Moving data just got easier. With PGLite, you can quickly import and export your database, whether you’re migrating, backing up, or setting up a fresh project. The Firebase team heard your feedback! You can now see the distance from the query vector in your similarity search results by selecting the _metadata.distance field: query movies_descriptionEmbedding_similarity( compare_embed: { within: where: { { id title description _metadata { distance } } } This makes it easy to choose a good value for within and tune your search performance. @check can now be used for queries as well as mutations! Define authorization rules with CEL expressions, allowing you to reference data from other tables and apply conditional logic for more precise access control. query user(id: $userId) { privacySetting @check expr: message: ) @redact favoriteMovies movie { id title genre } } } } Android developers, we’ve got something for you! The new quickstart sample app shows you how to use Firebase Data Connect in an Android app, so you can start building right away. Watch the Latest Livestream Want a closer look? We hung out with Firebase After Hours for a live demo and some great Q&A. Check out the replay here: Firebase After Hours #9: Firebase Data Connect: SQL or NoSQL, that is no longer the question Don’t forget to share your thoughts Production Web Architecture & Security Checklist Whether we are deploying on Firebase App Hosting, Cloudflare Workers, or Vercel, shipping SQL features to production requires defense-in-depth across three layers: - Enforce Firebase App Check & Attestation: **Protect your web endpoints, Cloud Functions, Data Connect GraphQL resolvers, and Firebase AI Logic calls against unauthorized replay or billing abuse using Firebase App Check with reCAPTCHA Enterprise**. - **Validate Locally with the Firebase Emulator Suite: **Run deterministic integration tests against local Firestore, Auth, Functions, and Data Connect PostgreSQL emulators before promoting schema or rule changes to production. - **Keep Server & Client Boundaries Type-Safe: **Use the modular Firebase Web SDK and generated TypeScript bindings so SSR frameworks like Next.js, Astro, SvelteKit, and Angular serialize state cleanly without hydration flickers. Conclusion Accelerate your full-stack web and AI development by pairing February Update: What's New in Data Connect with strict Security Rules, Firebase App Check, and local emulator testing. Come tell us on X (@CodingCatDev) and LinkedIn (CodingCat.dev) how you are using Firebase in your stack, and subscribe to the CodingCat.dev YouTube Channel so you don't miss what we build next! Watch Our Related Firebase Video Tutorial on YouTube Want to see how we architect and debug Firebase web applications live? Watch our related CodingCat.dev session Firebase SQL with Data Connect below, and make sure to Subscribe to CodingCat.dev on YouTube for weekly full-stack web and AI deep dives: {% youtube N25khadfUag %} Resources, Official Docs & Related CodingCat.dev Guides - Primary Release Source: **February Update: What's New in Data Connect on the Official Firebase Blog (published 2025-02-26 by Cynthia Wang) - **Official Firebase Documentation: **Firebase Developer Docs & Web SDK Reference - **Related on CodingCat.dev: Firebase + Gemini Code Assist - Related on CodingCat.dev: Add image generation to your apps with Imagen 3 - Related on CodingCat.dev: Firebase SQL with Data Connect - Related on CodingCat.dev: Build a Custom No-Code App in 90 Minutes Frequently Asked Questions (FAQ) What are the key capabilities introduced in February Update: What's New in Data Connect? February Update: What's New in Data Connect (announced 2025-02-26 by the Firebase team) enhances the platform for Firebase, Google Cloud, Web Dev, SQL, React, Security workloads. Note: Firebase Data Connect has been renamed to SQL Connect. Learn more in the SQL Connect announcement. Developers can review the primary announcement on the Firebase Blog alongside our implementation patterns and production checklist above. How do web developers use February Update: What's New in Data Connect with Next.js, SvelteKit, React, or Angular? Web developers can integrate these features using the modular Firebase JavaScript/TypeScript SDK, Firebase Data Connect web bindings, and Firebase App Hosting. Always pair client-side SDK initialization with Firebase App Check and strict Security Rules, and test locally with the Firebase Local Emulator Suite before deploying. Where can I watch video tutorials on Firebase Web and AI development? You can watch our hands-on Firebase video walkthroughs on the CodingCat.dev YouTube Channel, including Firebase SQL with Data Connect, and follow us on X (@CodingCatDev) for weekly full-stack tutorials.

Data Connect is now generally available! in Firebase: Web Architecture & Implementation Guide Original: codingcat.dev For years, choosing Firebase meant trading away relational SQL joins, strict foreign keys, and pgvector similarity search in favor of NoSQL document denormalization. Following the announcement of Data Connect is now generally available! by Andrea Wu on the Official Firebase Blog (2025-04-09), here is our hands-on CodingCat.dev breakdown of what actually shipped, how it works under the hood, and how we wire it into production TypeScript, Next.js, Astro, SvelteKit, React, and Angular applications. Note: Firebase Data Connect has been renamed to SQL Connect. Learn more in the SQL Connect announcement. The Mental Model: Why Data Connect is now generally available! Matters for Web Devs As a Google Developer Expert (GDE) for Firebase and Senior Solutions Engineer at CodingCat.dev, I evaluate every Firebase update through one lens: does it reduce boilerplate while keeping our runtime security and cloud bills predictable? Firebase Data Connect bridges that gap by pairing a managed Google Cloud SQL for PostgreSQL instance with a declarative GraphQL schema compiler that automatically generates type-safe TypeScript, React, and Angular SDKs alongside server-enforced @auth directives. > AJ Pro-Tip from Alex: Keep your authorization logic inside your Data Connect GraphQL operations using @auth(level: USER) and server-evaluated expressions like auth.uid and request.time rather than trusting client-supplied user IDs in query variables. How It Works: Technical Breakdown & Implementation Data Connect is a backend-as-a-service powered by a Cloud SQL Postgres database that’s high performance, scalable, and secure. You provide your app’s data model through a GraphQL-based schema, and Data Connect creates secure endpoints and typesafe SDKs to access your data. You’ll also define how to access and update data, and Data Connect does the rest for you - no need to define your own resolvers which is necessary in GraphQL services. You can build rich queries with relational joins, complex conditions, and even semantic vector search that are as secure as hand-coded server endpoints. Vector search and an integration with Vertex AI enables out-of-the-box RAG (retrieval augmented generation) flows. Also, just like the rest of the Firebase ecosystem, Data Connect is well-integrated with other Firebase services like Firebase Auth. the team has been hard at work creating additional features and in this blog post, we’ll cover a few of those below: - Gemini in Firebase for schema design in the Firebase console - Support for connecting to existing Cloud SQL databases - Newly supported web frameworks: Angular and React Gemini code assist Before, you could already use Gemini in Firebase to write queries and mutations for your app. Now, you can use it to write your schemas! Tell Gemini what you would like to build, and it writes the schemas for you. You can use this new feature in the Firebase console. More Query and Mutation Features When you have a lot of data, you might need to perform calculations on a list of results. Aggregate fields let you do so, and for each field in your type, Data Connect generates corresponding aggregate fields depending on the field type. Data Connect supports the following aggregations: - _count: returns the number of rows that match your query - All fields have a <field>_count field, which counts how many rows have a non-null value in that field - Numeric fields (int, float, int64) have <field>_min, <field>_max, <field>_sum, and <field>_avg - Date and timestamp fields have <field>_min and <field>_max. - distinct argument: get all unique values for a field (or combo of fields). You can also use distinct on aggregate fields to instead aggregate the distinct values. - Grouped aggregates: selecting a mix of aggregate and non-aggregate fields results in aggregate results grouped by the non-aggregate fields. where and having arguments return only groups that meet the provided criteria. where lets you filter rows based on non-aggregate fields and having lets you filter groups by aggregate fields. To learn more about aggregate fields and see examples, check out the documentation. To ensure data consistency and prevent race conditions - especially in collaborative or high-traffic applications, Data Connect now has atomic operations that let you manage counters, lists, and other data structures: - inc increments the field by the specified amount. - dec decrements the field by the specified amount. - prepend adds to the start of a list. To learn more about atomic data modifications and see examples, check out the documentation. Connect to Existing Cloud SQL Databases We know that you might already be using Cloud SQL databases. Now through the Firebase CLI, you can connect existing Cloud SQL databases to Data Connect. - give Data Connect control over the database to run migrations - connect in brownfield mode, in which you need to apply SQL changes yourself, then use the CLI to deploy the connector In both cases, you write the corresponding GraphQL schema and implement the operations for your connector. In other words, Data Connect doesn’t create GraphQL from your existing database. To learn more, check out the documentation. Angular and React Support As you design the schemas, queries, and mutations and deploy them to the Data Connect service, Data Connect automatically generates custom SDKs for you to use in your client logic. These SDKs let you call server-side queries and mutations directly from a Firebase app. Back in February, we announced support for React, letting you generate React SDKs for your projects with bindings powered by TanStack Query to integrate your GraphQL operations into your React-based apps. Now, The Firebase team announced support for Angular as well! You first need to install the dependencies, and then Data Connect will automatically generate Angular SDKs. You can then use these SDKs for queries and mutations in your Angular app. To learn more and see examples, check out the documentation. Try the new Android and iOS Codelabs With the Data Connect web codelab out there for web users, we definitely didn’t want to leave the fun out for our Android and iOS users! The Firebase team announced the new Android and iOS codelabs, designed to help you walk through implementation of a fully functioning mobile app using Data Connect. Pricing Updates With Data Connect now generally available, it will transition to its GA pricing structure. At a high level, Data Connect consists of two billable components: the Data Connect service itself and the PostgreSQL instance on Cloud SQL that contains your project data. The cost for the Data Connect service is: - no cost for network egress up to 10 GiB/month, and then it will follow Google Cloud Internet Data Transfer Rate Premium Tier pricing. There may be potential additional costs that you can read about in the documentation - but the good news is network egress is only charged once for data going out of your database - no cost for operations (queries and mutations) up to 250k operations per month, and then the cost is $4.00 per 1M operations The cost for the PostgreSQL instance on Cloud SQL is a no-cost trial for 3 months, then permanent costs as low as $9.37 per month that follows Google Cloud pricing. Additionally, if you use Data Connect for vector similarity search, you need to integrate Vertex AI’s Embeddings API. As such, there will be associated costs for embedding generation. To learn more, check out the documentation. Try out Data Connect! To learn more about Data Connect, here are some resources: - documentation (along with one-liner setup) - web, Android, iOS, Dart quickstarts to get a sample app up and running - web, Android, iOS codelabs with step-by-step walkthroughs and explanations to create a movie app - blog post series deep-diving into various Data Connect topics Show Me the Code: TypeScript & Web SDK Setup Here is the production baseline pattern we use at CodingCat.dev when wiring Data Connect is now generally available! into a modern TypeScript web application: # Firebase Data Connect Schema & Type-Safe Web Query type Project @table { id: UUID! @default(expr: "uuidV4()") title: String! ownerUid: String! @default(expr: "auth.uid") createdAt: Timestamp! @default(expr: "request.time") } query ListUserProjects @auth(level: USER) { projects(where: { ownerUid: { eq_expr: "auth.uid" } }, orderBy: [{ createdAt: DESC }]) { id title createdAt } } Production Web Architecture & Security Checklist Whether we are deploying on Firebase App Hosting, Cloudflare Workers, or Vercel, shipping AI features to production requires defense-in-depth across three layers: - Enforce Firebase App Check & Attestation: **Protect your web endpoints, Cloud Functions, Data Connect GraphQL resolvers, and Firebase AI Logic calls against unauthorized replay or billing abuse using Firebase App Check with reCAPTCHA Enterprise**. - **Validate Locally with the Firebase Emulator Suite: **Run deterministic integration tests against local Firestore, Auth, Functions, and Data Connect PostgreSQL emulators before promoting schema or rule changes to production. - **Keep Server & Client Boundaries Type-Safe: **Use the modular Firebase Web SDK and generated TypeScript bindings so SSR frameworks like Next.js, Astro, SvelteKit, and Angular serialize state cleanly without hydration flickers. Conclusion Accelerate your full-stack web and AI development by pairing Data Connect is now generally available! with strict Security Rules, Firebase App Check, and local emulator testing. Come tell us on X (@CodingCatDev) and LinkedIn (CodingCat.dev) how you are using Firebase in your stack, and subscribe to the CodingCat.dev YouTube Channel so you don't miss what we build next! Watch Our Related Firebase Video Tutorial on YouTube Want to see how we architect and debug Firebase web applications live? Watch our related CodingCat.dev session Firebase SQL with Data Connect below, and make sure to Subscribe to CodingCat.dev on YouTube for weekly full-stack web and AI deep dives: {% youtube N25khadfUag %} Resources, Official Docs & Related CodingCat.dev Guides - Primary Release Source: **Data Connect is now generally available! on the Official Firebase Blog (published 2025-04-09 by Andrea Wu) - **Official Firebase Documentation: **Firebase Developer Docs & Web SDK Reference - **Related on CodingCat.dev: What's new in Firebase at Cloud Next 2025 - Related on CodingCat.dev: Announcing Genkit for Python and Go - Related on CodingCat.dev: Firebase SQL with Data Connect - Related on CodingCat.dev: Build a Custom No-Code App in 90 Minutes Frequently Asked Questions (FAQ) What are the key capabilities introduced in Data Connect is now generally available!? Data Connect is now generally available! (announced 2025-04-09 by the Firebase team) enhances the platform for Firebase, Google Cloud, Web Dev, AI, SQL, React, Angular, TypeScript, Security workloads. Note: Firebase Data Connect has been renamed to SQL Connect. Learn more in the SQL Connect announcement. Developers can review the primary announcement on the Firebase Blog alongside our implementation patterns and production checklist above. How do web developers use Data Connect is now generally available! with Next.js, SvelteKit, React, or Angular? Web developers can integrate these features using the modular Firebase JavaScript/TypeScript SDK, Firebase Data Connect web bindings, and Firebase App Hosting. Always pair client-side SDK initialization with Firebase App Check and strict Security Rules, and test locally with the Firebase Local Emulator Suite before deploying. Where can I watch video tutorials on Firebase Web and AI development? You can watch our hands-on Firebase video walkthroughs on the CodingCat.dev YouTube Channel, including Firebase SQL with Data Connect, and follow us on X (@CodingCatDev) for weekly full-stack tutorials.

Eval-driven development: How we build better agent skills for Firebase: Web Architecture & Implementation Guide Original: codingcat.dev If you have ever watched an AI coding agent hallucinate deprecated Firebase v8 syntax or deploy wide-open Firestore rules, you know that raw LLM prompts are not enough for production backends. Following the announcement of Eval-driven development: How we build better agent skills for Firebase by Charlotte Liang on the Official Firebase Blog (2026-08-11), here is our hands-on CodingCat.dev breakdown of what actually shipped, how it works under the hood, and how we wire it into production TypeScript, Next.js, Astro, SvelteKit, React, and Angular applications. Earlier, the Firebase team introduced Firebase Agent Skills, our way of giving AI agents the structured cheat sheets they need to write better Firebase code. the agent skills help coding agents navigate Firebase’s latest APIs, avoid deprecated features, and follow our best practices. The Mental Model: Why Eval-driven development: How we build better agent skills for Firebase Matters for Web Devs As a Google Developer Expert (GDE) for Firebase and Senior Solutions Engineer at CodingCat.dev, I evaluate every Firebase update through one lens: does it reduce boilerplate while keeping our runtime security and cloud bills predictable? Instead of relying on stale training weights, wiring up the Model Context Protocol (MCP) and structured Firebase agent skills gives your IDE or CLI direct, schema-aware tools to provision resources, inspect security rules, and run deterministic CLI deployments. > AJ Pro-Tip from Alex: Never let an autonomous coding agent push Firestore or Data Connect rules straight to production without a gate. Always require the agent to run your test suite against the Firebase Local Emulator Suite first, and audit every generated rule for strict request.auth.uid ownership checks. How It Works: Technical Breakdown & Implementation The agentic toolkit: CLI, MCP servers, and skills Skills don’t operate in a vacuum - they need great tools as well. We provide two types of tools for agents to use: the Firebase CLI and the MCP servers. - CLIs are loved by AI agents for their straightforward execution and terminal-based workflows. - MCP servers are “agent friendly” because of the explicit tool definitions that let agents understand exactly what a tool does and what arguments it requires. So, where do agent skills fit into this picture? Skills are the conductor that orchestrates everything together. To get more accurate results, I recommend developers enable and install both the Firebase Agent Skills and the Firebase MCP server. The Firebase local MCP server includes tools to access the Google Developer Knowledge MCP server. This connection seamlessly guides agents to search and read official Google documentation, including Firebase. You might wonder: What is the difference between an agent skill and official documentation? While documentation provides comprehensive reference material, skills are highly focused, outcome-driven cheat sheets. They are specifically designed to onboard users to Firebase products, enforce core principles, highlight best practices, and provide preemptive guidance for tasks where agents are known to struggle. For example, a skill can help a developer add a feature in their app that securely uses Firestore database, everything from provisioning in the cloud to writing the app code for interacting with the database. We even have agent skills that review and help to write robust Firebase Security Rules to protect user data. Furthermore, skills act as a vital bridge for agent knowledge. Because LLMs are limited by training data cut-off dates, they won’t know about recent releases and changes. A skill can explicitly instruct the agent to use the CLI or an MCP server tool to implement the feature (or to read the latest documentation), ensuring the model can discover and utilize brand-new features on the fly. The need for measurement As Firebase expanded this toolkit and wrote more agent skills, we ran into a critical question: how do we actually know if these skills are helping agents succeed? We couldn’t just create skills and hope for the best. An agent might misinterpret a prompt, fail to activate the right skill, or get tripped up by a fragile workflow. We needed a way to programmatically measure an agent’s success rate. To solve this, we built a set of evals, automated prompt suites that score how well an agent completes specific Critical User Journeys (CUJs). We use a few different types of evals to understand exactly how agents use our products: Single skill evaluations: This is the simplest and most important type of eval. It provides the agent with a single skill, for instance the firebase-firestore skill, and evaluates its core functionality against 5-10 specific cases per CUJ. Here’s an example of what skill evaluation looks like: prompt expectations - - Skill activation evaluations: Having a great skill doesn’t matter if the agent doesn’t know when to use it! Activation evals test the skill’s frontmatter (name and description). We run a mix of positive and negative prompts to ensure the agent activates the skill when needed, without over-activating on irrelevant prompts. prompt expected_skills - E2E multi-skill evaluations: These are the ultimate test. We provide the agent with all the skills and ask it to create and deploy an app that uses multiple Firebase products. These evals interact with a real Firebase project to ensure the skills work together in a realistic environment. prompt expectations - - - - - - When we first started developing the agent skills, it was easier and faster to just write what we thought were important instructions for the agent. However, with our evolution to evaluation-driven development of skills, we now know what instructions are important because we can now start with the test and then write and iterate on skills until the agent succeeds. Here is what the eval-driven development iteration loop looks like today, which we start adopting not only to refine the skills, but to uncover friction in the CLI and MCP servers as well: **Write the eval first **Before we write any agent skills, we define the expected outcome for a task. We set strict LLM-as-a-judge expectations for what a successful Firebase implementation looks like. **Establish a baseline **We prompt the agent to complete the task without providing the agent any of the Firebase agent skills, which lets us capture a baseline failure rate. **Add and refine skills **Next, we write the skill. We look for what failed in the baseline evaluation, and include specific procedural steps, mandatory flags, and “gotchas” into the agent skills to address the agent’s exact pain points. **Hill climb **We re-run the evaluation. If the score goes up, we keep the changes. We iterate on this loop until the agent consistently passes the eval. By adopting an eval-first mindset and building a cohesive toolkit of skills and servers, we stopped guessing what agents might misunderstand and started programmatically proving it. To show just how much of a difference this makes, we compared the baseline performance of an agent without skills against an agent equipped with our tuned Firebase agent skills. To interpret the data below, the following definitions describe how resources are measured: - Input Tokens: The number of tokens the model reads. This includes the original prompt, agent skills, tool definitions (such as CLI or MCP tool descriptions), error messages, and web searches. A reduction in input tokens suggests the agent spent less wasted time searching for context. - Output Tokens: The actual response provided to the user, including code written and internal “thinking” tokens. A reduction in output tokens suggests a more concise answer, less effort spent rewriting code, and a more streamlined reasoning process. Eval results demonstrate that integrating Skills raises pass rate from 31.7% to 78.0% alongside substantial reductions in token overhead and execution time. An important impact of eval-driven development is that it doesn’t just help us write better skills, it helps us build better tools. When we watch an agent repeatedly fail a task even after we’ve given it a well-written skill, it acts as a harsh usability test. It’s a strong signal that the underlying workflow or command is too complex, fragile, or confusing. We can take these insights and use them to improve the Firebase CLI and our MCP tools, streamlining the developer experience for both AI agents and human developers. We’ve written an evaluation suite for Firebase CLI usage, with ~50 cases covering common developer tasks, and we’ve started to use this suite to optimize the CLI for agents. In the past few weeks, we’ve used this approach to improve help text, provide smoother login for agents, and fix cases where agents were blocked by interactive prompts. We think this approach is the best way to build effective, agent friendly tooling, and we expect to use it much more in the coming months. Production Web Architecture & Security Checklist Whether we are deploying on Firebase App Hosting, Cloudflare Workers, or Vercel, shipping AI features to production requires defense-in-depth across three layers: - Enforce Firebase App Check & Attestation: **Protect your web endpoints, Cloud Functions, Data Connect GraphQL resolvers, and Firebase AI Logic calls against unauthorized replay or billing abuse using Firebase App Check with reCAPTCHA Enterprise**. - **Validate Locally with the Firebase Emulator Suite: **Run deterministic integration tests against local Firestore, Auth, Functions, and Data Connect PostgreSQL emulators before promoting schema or rule changes to production. - **Keep Server & Client Boundaries Type-Safe: **Use the modular Firebase Web SDK and generated TypeScript bindings so SSR frameworks like Next.js, Astro, SvelteKit, and Angular serialize state cleanly without hydration flickers. Conclusion Accelerate your full-stack web and AI development by pairing Eval-driven development: How we build better agent skills for Firebase with strict Security Rules, Firebase App Check, and local emulator testing. Come tell us on X (@CodingCatDev) and LinkedIn (CodingCat.dev) how you are using Firebase in your stack, and subscribe to the CodingCat.dev YouTube Channel so you don't miss what we build next! Watch Our Related Firebase Video Tutorial on YouTube Want to see how we architect and debug Firebase web applications live? Watch our related CodingCat.dev session Firebase Security Rules: Effortless control over your app's data. below, and make sure to Subscribe to CodingCat.dev on YouTube for weekly full-stack web and AI deep dives: {% youtube wGbEM0CXMuI %} Resources, Official Docs & Related CodingCat.dev Guides - Primary Release Source: **Eval-driven development: How we build better agent skills for Firebase on the Official Firebase Blog (published 2026-08-11 by Charlotte Liang) - **Official Firebase Documentation: **Firebase Developer Docs & Web SDK Reference - **Related on CodingCat.dev: Triple-layer security for Firebase web apps - Related on CodingCat.dev: 3 ways to optimize Firebase Remote Config fetch usage - Related on CodingCat.dev: Firebase SQL with Data Connect - Related on CodingCat.dev: Build a Custom No-Code App in 90 Minutes Frequently Asked Questions (FAQ) What are the key capabilities introduced in Eval-driven development: How we build better agent skills for Firebase? Eval-driven development: How we build better agent skills for Firebase (announced 2026-08-11 by the Firebase team) enhances the platform for Firebase, Google Cloud, Web Dev, AI, MCP, Security workloads. Earlier, the Firebase team introduced Firebase Agent Skills, our way of giving AI agents the structured cheat sheets they need to write better Firebase code. the agent skills help coding agents navigate Firebase’s latest APIs, avoid deprecated features, and follow our best practices. Developers can review the primary announcement on the Firebase Blog alongside our implementation patterns and production checklist above. How do web developers use Eval-driven development: How we build better agent skills for Firebase with Next.js, SvelteKit, React, or Angular? Web developers can integrate these features using the modular Firebase JavaScript/TypeScript SDK, Firebase Data Connect web bindings, and Firebase App Hosting. Always pair client-side SDK initialization with Firebase App Check and strict Security Rules, and test locally with the Firebase Local Emulator Suite before deploying. Where can I watch video tutorials on Firebase Web and AI development? You can watch our hands-on Firebase video walkthroughs on the CodingCat.dev YouTube Channel, including Firebase Security Rules: Effortless control over your app's data., and follow us on X (@CodingCatDev) for weekly full-stack tutorials.

Hey, @twerske I'm not sure if you can help out, but maybe 😅🍀 Just as a general thought. This is the most upvoted issue on flutterfire: flutterfire#17338 IMO this is one of the greatest misses on Flutter Linux desktop. We can't use Firebase there (full Google end-to-end)

firebase-ios-sdk#16972 Firebase v13からSceneDelegateを考慮するようになってFIAMのactionURLがhttpsだとどんなURLもUniversalLinkとして流れてくるのが困るよーというIssue

Can Firebase provide native per-user Firestore rate limits without replacing realtime listeners? I am building an app around Firestore's direct client SDK, realtime listeners and offline cache. I want to keep that architecture, but I cannot find a supported native way to cap an otherwise authorised user's billable reads/writes across devices and concurrent connections. The existing feature request dates from April 2023 and currently has 73 votes: firebase.uservoice.com There are concrete adoption concerns in its comments: Al3life reports moving to Supabase for this feature, capTarget archery says it may rule Firebase out for future projects, and Anatole Couasnon describes adding an API despite choosing Firebase for direct access. These are individual reports, not a survey, but they match the concern blocking my confidence in launching. I am not asking for authentication or permissions to be replaced. Rules limit what a user can access, but a query-size limit does not limit how often an allowed query runs. App Check attests clients; it is not a configurable allowance for each UID. Budget alerts do not stop usage. Cloud Armor in front of my own API does not control the Google-managed Firestore endpoint the SDK calls. A custom API/SSE/WebSocket gateway could control traffic routed through it, but rebuilding native listener synchronisation, reconnect handling, cache behaviour and authorisation adds infrastructure, cost and complexity. That is not a viable equivalent for this application. An after-read trigger alone would also be too late to stop the triggering charge or a concurrent burst. What I would like Firebase to provide is a simple console or rules-level policy, enforced by the service: per-UID rolling/burst allowances shared across devices, plus a database/project backstop. It needs to address document/query volume, writes, initial listener snapshots, subsequent billable updates and reconnects, with clear charging and quota-exceeded semantics. I appreciate that the implementation may be more complex than the setting exposed to developers. I submitted a detailed feature request yesterday and have asked our Google Cloud contacts to escalate it. Is there a Firestore product owner who can give this an explicit status or link it to the right backend tracker? If a supported solution now preserves direct SDK listeners and actually enforces the allowance, I would welcome a documentation link. Otherwise, please treat this as an adoption and cost-abuse concern that needs an owned response. Related history: firebase-js-sdk#647 Official App Check limitations: firebase.google.com Budget guidance: firebase.google.com