D.4 Phone Number

Authenticate with Firebase using a Phone Number

You can use Firebase Authentication to sign in a user by sending an SMS message to the user's phone. The user signs in using a one-time code contained in the SMS message.

⭐ Phone numbers that end users provide for authentication will be sent and stored by Google to improve our spam and abuse prevention across Google services, including but not limited to Firebase. Developers should ensure they have appropriate end-user consent prior to using the Firebase Authentication phone number sign-in service.

Security concerns

Authentication using only a phone number, while convenient, is less secure than the other available methods, because possession of a phone number can be easily transferred between users. Also, on devices with multiple user profiles, any user that can receive SMS messages can sign in to an account using the device's phone number.

If you use phone number based sign-in in your app, you should offer it alongside more secure sign-in methods, and inform users of the security tradeoffs of using phone number sign-in.

Enable Phone Number sign-in for your Firebase project

To sign in users by SMS, you must first enable the Phone Number sign-in method for your Firebase project:

1. In the Firebase console, open the Authentication section.
2. On the Sign-in Method page, enable the Phone Number sign-in method.
3. On the iOS side, your app must be able to receive FCM. To do that, make sure you have installed the FCM ANE first.

Send a verification code to the user's phone

To initiate phone number sign-in, present the user an interface that prompts them to type their phone number. Legal requirements vary, but as a best practice and to set expectations for your users, you should inform them that if they use phone sign-in, they might receive an SMS message for verification and standard rates apply.

Then, pass their phone number to the Auth.verifyPhoneNumber method to request that Firebase verify the user's phone number. For example:

Auth.listener.addEventListener(AuthEvents.PHONE_VERIFICATION_RESULT, onPhoneVerificationResult);
Auth.listener.addEventListener(AuthEvents.PHONE_CODE_SENT, onPhoneCodeSent);
Auth.listener.addEventListener(AuthEvents.PHONE_AUTO_RETRIEVAL_TIME_OUT, onPhoneTimeout);

// phone number format: +(country code)(mobile number with no initial zero)
Auth.verifyPhoneNumber("+11234567890");

private function onPhoneVerificationResult(e:AuthEvents):void
{
	// You don't need to do anything when the verification is successful
	// On a successful verification, the ANE will try to sign-in the user automatically.
	trace("PHONE_VERIFICATION_RESULT, smsCode = " + e.smsCode);
	trace("PHONE_VERIFICATION_RESULT, msg = " + e.msg);
}

private function onPhoneCodeSent(e:AuthEvents):void
{
	// On most Android devices, the ANE reads the sms automatically so you don't have to
	// pass the verificationId + the user input (the sms code) to the signIn method.
	// But on iOS, and sometimes on Android, you MUST save the verificationId and later
	// pass it to Auth.signIn(authProvider.getCredential());
	trace("PHONE_CODE_SENT, verificationId = " + e.verificationId);
}

function onPhoneTimeout(e:AuthEvents):void
{
	C.log("PHONE_AUTO_RETRIEVAL_TIME_OUT, verificationId = " + e.verificationId);
}

The SMS message sent by Firebase can also be localized by specifying the auth language via setting the languageCode property on your Auth instance.

Auth.languageCode = "fr";

// To apply the default app language instead of explicitly setting it.
// Auth.useAppLanguage();

if AuthEvents.PHONE_VERIFICATION_RESULT is not happening (on iOS and some Android devices) you need to use the verificationId you received from AuthEvents.PHONE_CODE_SENT and sign in like below:

// create a new authProvider object first
var authProvider:AuthProvider = new AuthProvider();

// decide what kind of credential this authProvider instance will hold
authProvider.setPhoneAuthProvider("verificationId-received-from-AuthEvents.PHONE_CODE_SENT", "SMS-code-found-in-the-sms");

// and finally feed Auth.signIn method with the parsed credential info from the authProvider instance.
Auth.signIn(authProvider.getCredential());

As before, you need to listen to the AuthEvents.SIGN_IN_RESULT event to see the sign in callback.

⭐ You can allow users to sign in to your app using multiple authentication providers by linking auth provider credentials to an existing user account.