your firebase app verification code is

You can use Firebase Authentication to lớn sign in a user by sending an SMS message to the user's phone. The user signs in using a one-time code contained in the SMS message.

The easiest way to lớn add phone number sign-in to lớn your phầm mềm is to lớn use FirebaseUI, which includes a drop-in sign-in widget that implements sign-in flows for phone number sign-in, as well as password-based and federated sign-in. This document describes how to lớn implement a phone number sign-in flow using the Firebase SDK.

Bạn đang xem: your firebase app verification code is

Before you begin

1. If you haven't already, add Firebase to lớn your Android project.
2. In your module (app-level) Gradle file (usually <project>/<app-module>/build.gradle.kts or <project>/<app-module>/build.gradle), add the dependency for the Firebase Authentication library for Android. We recommend using the Firebase Android BoM to control library versioning.

   dependencies {
       // Import the BoM for the Firebase platform
       implementation(platform("com.google.firebase:firebase-bom:32.4.0"))
   
       // Add the dependency for the Firebase Authentication library
       // When using the BoM, you don't specify versions in Firebase library dependencies
       implementation("com.google.firebase:firebase-auth")
   }
   

   By using the Firebase Android BoM, your phầm mềm will always use compatible versions of Firebase Android libraries.

   (Alternative) Add Firebase library dependencies without using the BoM

   If you choose not to lớn use the Firebase BoM, you must specify each Firebase library version in its dependency line.

   Note that if you use multiple Firebase libraries in your phầm mềm, we strongly recommend using the BoM to lớn manage library versions, which ensures that all versions are compatible.

   dependencies {
       // Add the dependency for the Firebase Authentication library
       // When NOT using the BoM, you must specify versions in Firebase library dependencies
       implementation("com.google.firebase:firebase-auth:22.2.0")
   }
   

   Looking for a Kotlin-specific library module? Starting with the October 2023 release, both Kotlin and Java developers can depend on the main library module (for details, see the FAQ about this initiative).
3. If you haven't yet connected your phầm mềm to lớn your Firebase project, tự sánh from the Firebase console.
4. If you haven't already phối your app's SHA-1 hash in the Firebase console, tự sánh. See Authenticating Your Client for information about finding your app's SHA-1 hash.

Security concerns

Authentication using only a phone number, while convenient, is less secure than the other available methods, because possession of a phone number can be easily transferred between users. Also, on devices with multiple user profiles, any user that can receive SMS messages can sign in to lớn an tài khoản using the device's phone number.

If you use phone number based sign-in in your phầm mềm, you should offer it alongside more secure sign-in methods, and inform users of the security tradeoffs of using phone number sign-in.

Enable Phone Number sign-in for your Firebase project

To sign in users by SMS, you must first enable the Phone Number sign-in method for your Firebase project:

1. In the Firebase console, open the Authentication section.
2. On the Sign-in Method page, enable the Phone Number sign-in method.

Firebase's phone number sign-in request quota is high enough that most apps won't be affected. However, if you need to lớn sign in a very high volume of users with phone authentication, you might need to lớn upgrade your pricing plan. See the pricing page.

Enable phầm mềm verification

To use phone number authentication, Firebase must be able to lớn verify that phone number sign-in requests are coming from your phầm mềm. There are three ways Firebase Authentication accomplishes this:

• Play Integrity API: If a user has a device with Google Play services installed, and Firebase Authentication can verify the device as legitimate with the Play Integrity API, phone number sign-in can proceed. The Play Integrity API is enabled on a Google-owned project by Firebase Authentication, not on your project. This does not contribute to lớn any Play Integrity API quotas on your project. Play Integrity Support is available with the Authentication SDK v21.2.0+ (Firebase BoM v31.4.0+).

  To use Play Integrity, if you haven't yet specified your app's SHA-256 fingerprint, tự so from the Project settings of the Firebase console. Refer to Authenticating Your Client for details on how to lớn get your app's SHA-256 fingerprint.

• reCAPTCHA verification: In the sự kiện that Play Integrity cannot be used, such as when a user has a device without Google Play services installed, Firebase Authentication uses a reCAPTCHA verification to lớn complete the phone sign-in flow. The reCAPTCHA challenge can often be completed without the user having to lớn solve anything. Note that this flow requires that a SHA-1 is associated with your application. This flow also requires your API Key to lớn be unrestricted or allowlisted for PROJECT_ID.firebaseapp.com.

  Some scenarios where reCAPTCHA is triggered:

  • If the end-user's device does not have Google Play services installed.
  • If the phầm mềm is not distributed through Google Play store (on Authentication SDK v21.2.0+).
  • If the obtained SafetyNet token was not valid (on Authentication SDK versions v21.2.0).

  When SafetyNet or Play Integrity is used for App verification, the %APP_NAME% field in the SMS template is populated with the phầm mềm name determined from Google Play store. In the scenarios where reCAPTCHA is triggered, %APP_NAME% is populated as PROJECT_ID.firebaseapp.com.

You can force the reCAPTCHA verification flow with forceRecaptchaFlowForTesting You can disable phầm mềm verification (when using fictional phone numbers) using setAppVerificationDisabledForTesting.

Troubleshooting

• "Missing initial state" error when using reCAPTCHA for phầm mềm verification

  This can occur when the reCAPTCHA flow completes successfully but does not redirect the user back to lớn the native application. If this occurs, the user is redirected to lớn the fallback URL PROJECT_ID.firebaseapp.com/__/auth/handler. On Firefox browsers, opening native phầm mềm links is disabled by mặc định. If you see the above error on Firefox, follow the steps in Set Firefox for Android to lớn open links in native apps to lớn enable opening phầm mềm links.

Send a verification code to lớn the user's phone

To initiate phone number sign-in, present the user an interface that prompts them to lớn type their phone number. Legal requirements vary, but as a best practice and to lớn phối expectations for your users, you should inform them that if they use phone sign-in, they might receive an SMS message for verification and standard rates apply.

Then, pass their phone number to lớn the PhoneAuthProvider.verifyPhoneNumber method to lớn request that Firebase verify the user's phone number. For example:

val options = PhoneAuthOptions.newBuilder(auth)
    .setPhoneNumber(phoneNumber) // Phone number to lớn verify
    .setTimeout(60L, TimeUnit.SECONDS) // Timeout and unit
    .setActivity(this) // Activity (for callback binding)
    .setCallbacks(callbacks) // OnVerificationStateChangedCallbacks
    .build()
PhoneAuthProvider.verifyPhoneNumber(options)

PhoneAuthOptions options = 
  PhoneAuthOptions.newBuilder(mAuth) 
      .setPhoneNumber(phoneNumber)       // Phone number to lớn verify
      .setTimeout(60L, TimeUnit.SECONDS) // Timeout and unit
      .setActivity(this)                 // (optional) Activity for callback binding
      // If no activity is passed, reCAPTCHA verification can not be used.
      .setCallbacks(mCallbacks)          // OnVerificationStateChangedCallbacks
      .build();
  PhoneAuthProvider.verifyPhoneNumber(options);     

The verifyPhoneNumber method is reentrant: if you Hotline it multiple times, such as in an activity's onStart method, the verifyPhoneNumber method will not send a second SMS unless the original request has timed out.

You can use this behavior to lớn resume the phone number sign in process if your app closes before the user can sign in (for example, while the user is using their SMS app). After you Hotline verifyPhoneNumber, phối a flag that indicates verification is in progress. Then, save the flag in your Activity's onSaveInstanceState method and restore the flag in onRestoreInstanceState. Finally, in your Activity's onStart method, kiểm tra if verification is already in progress, and if sánh, Hotline verifyPhoneNumber again. Be sure to lớn clear the flag when verification completes or fails (see Verification callbacks).

To easily handle screen rotation and other instances of Activity restarts, pass your Activity to lớn the verifyPhoneNumber method. The callbacks will be auto-detached when the Activity stops, sánh you can freely write UI transition code in the callback methods.

The SMS message sent by Firebase can also be localized by specifying the auth language via the setLanguageCode method on your Auth instance.

auth.setLanguageCode("fr")
// To apply the mặc định phầm mềm language instead of explicitly setting it.
// auth.useAppLanguage()

auth.setLanguageCode("fr");
// To apply the mặc định phầm mềm language instead of explicitly setting it.
// auth.useAppLanguage();

When you Hotline PhoneAuthProvider.verifyPhoneNumber, you must also provide an instance of OnVerificationStateChangedCallbacks, which contains implementations of the callback functions that handle the results of the request. For example:

callbacks = object : PhoneAuthProvider.OnVerificationStateChangedCallbacks() {

    override fun onVerificationCompleted(credential: PhoneAuthCredential) {
        // This callback will be invoked in two situations:
        // 1 - Instant verification. In some cases the phone number can be instantly
        //     verified without needing to lớn send or enter a verification code.
        // 2 - Auto-retrieval. On some devices Google Play services can automatically
        //     detect the incoming verification SMS and perform verification without
        //     user action.
        Log.d(TAG, "onVerificationCompleted:$credential")
        signInWithPhoneAuthCredential(credential)
    }

    override fun onVerificationFailed(e: FirebaseException) {
        // This callback is invoked in an invalid request for verification is made,
        // for instance if the the phone number format is not valid.
        Log.w(TAG, "onVerificationFailed", e)

        if (e is FirebaseAuthInvalidCredentialsException) {
            // Invalid request
        } else if (e is FirebaseTooManyRequestsException) {
            // The SMS quota for the project has been exceeded
        } else if (e is FirebaseAuthMissingActivityForRecaptchaException) {
            // reCAPTCHA verification attempted with null Activity
        }

        // Show a message and update the UI
    }

    override fun onCodeSent(
        verificationId: String,
        token: PhoneAuthProvider.ForceResendingToken,
    ) {
        // The SMS verification code has been sent to lớn the provided phone number, we
        // now need to lớn ask the user to lớn enter the code and then construct a credential
        // by combining the code with a verification ID.
        Log.d(TAG, "onCodeSent:$verificationId")

        // Save verification ID and resending token sánh we can use them later
        storedVerificationId = verificationId
        resendToken = token
    }
}

mCallbacks = new PhoneAuthProvider.OnVerificationStateChangedCallbacks() {

    @Override
    public void onVerificationCompleted(@NonNull PhoneAuthCredential credential) {
        // This callback will be invoked in two situations:
        // 1 - Instant verification. In some cases the phone number can be instantly
        //     verified without needing to lớn send or enter a verification code.
        // 2 - Auto-retrieval. On some devices Google Play services can automatically
        //     detect the incoming verification SMS and perform verification without
        //     user action.
        Log.d(TAG, "onVerificationCompleted:" + credential);

        signInWithPhoneAuthCredential(credential);
    }

    @Override
    public void onVerificationFailed(@NonNull FirebaseException e) {
        // This callback is invoked in an invalid request for verification is made,
        // for instance if the the phone number format is not valid.
        Log.w(TAG, "onVerificationFailed", e);

        if (e instanceof FirebaseAuthInvalidCredentialsException) {
            // Invalid request
        } else if (e instanceof FirebaseTooManyRequestsException) {
            // The SMS quota for the project has been exceeded
        } else if (e instanceof FirebaseAuthMissingActivityForRecaptchaException) {
            // reCAPTCHA verification attempted with null Activity
        }

        // Show a message and update the UI
    }

    @Override
    public void onCodeSent(@NonNull String verificationId,
                           @NonNull PhoneAuthProvider.ForceResendingToken token) {
        // The SMS verification code has been sent to lớn the provided phone number, we
        // now need to lớn ask the user to lớn enter the code and then construct a credential
        // by combining the code with a verification ID.
        Log.d(TAG, "onCodeSent:" + verificationId);

        // Save verification ID and resending token sánh we can use them later
        mVerificationId = verificationId;
        mResendToken = token;
    }
};

Verification callbacks

In most apps, you implement the onVerificationCompleted, onVerificationFailed, and onCodeSent callbacks. You might also implement onCodeAutoRetrievalTimeOut, depending on your app's requirements.

onVerificationCompleted(PhoneAuthCredential)

This method is called in two situations:

• Instant verification: in some cases the phone number can be instantly verified without needing to lớn send or enter a verification code.
• Auto-retrieval: on some devices, Google Play services can automatically detect the incoming verification SMS and perform verification without user action. (This capability might be unavailable with some carriers.) This uses the SMS Retriever API, which includes an 11 character hash at the kết thúc of the SMS message.

In either case, the user's phone number has been verified successfully, and you can use the PhoneAuthCredential object that's passed to lớn the callback to lớn sign in the user.

onVerificationFailed(FirebaseException)

This method is called in response to lớn an invalid verification request, such as a request that specifies an invalid phone number or verification code.

onCodeSent(String verificationId, PhoneAuthProvider.ForceResendingToken)

Optional. This method is called after the verification code has been sent by SMS to lớn the provided phone number.

Xem thêm: công thức vật lý 10

When this method is called, most apps display a UI that prompts the user to lớn type the verification code from the SMS message. (At the same time, auto-verification might be proceeding in the background.) Then, after the user types the verification code, you can use the verification code and the verification ID that was passed to lớn the method to lớn create a PhoneAuthCredential object, which you can in turn use to lớn sign in the user. However, some apps might wait until onCodeAutoRetrievalTimeOut is called before displaying the verification code UI (not recommended).

onCodeAutoRetrievalTimeOut(String verificationId)

Optional. This method is called after the timeout duration specified to verifyPhoneNumber has passed without onVerificationCompleted triggering first. On devices without SIM cards, this method is called immediately because SMS auto-retrieval isn't possible.

Some apps block user input until the auto-verification period has timed out, and only then display a UI that prompts the user to lớn type the verification code from the SMS message (not recommended).

Create a PhoneAuthCredential object

After the user enters the verification code that Firebase sent to lớn the user's phone, create a PhoneAuthCredential object, using the verification code and the verification ID that was passed to lớn the onCodeSent or onCodeAutoRetrievalTimeOut callback. (When onVerificationCompleted is called, you get a PhoneAuthCredential object directly, sánh you can skip this step.)

To create the PhoneAuthCredential object, call PhoneAuthProvider.getCredential:

val credential = PhoneAuthProvider.getCredential(verificationId!!, code)

PhoneAuthCredential credential = PhoneAuthProvider.getCredential(verificationId, code);

Sign in the user

After you get a PhoneAuthCredential object, whether in the onVerificationCompleted callback or by calling PhoneAuthProvider.getCredential, complete the sign-in flow by passing the PhoneAuthCredential object to FirebaseAuth.signInWithCredential:

private fun signInWithPhoneAuthCredential(credential: PhoneAuthCredential) {
    auth.signInWithCredential(credential)
        .addOnCompleteListener(this) { task ->
            if (task.isSuccessful) {
                // Sign in success, update UI with the signed-in user's information
                Log.d(TAG, "signInWithCredential:success")

                val user = task.result?.user
            } else {
                // Sign in failed, display a message and update the UI
                Log.w(TAG, "signInWithCredential:failure", task.exception)
                if (task.exception is FirebaseAuthInvalidCredentialsException) {
                    // The verification code entered was invalid
                }
                // Update UI
            }
        }
}

private void signInWithPhoneAuthCredential(PhoneAuthCredential credential) {
    mAuth.signInWithCredential(credential)
            .addOnCompleteListener(this, new OnCompleteListener<AuthResult>() {
                @Override
                public void onComplete(@NonNull Task<AuthResult> task) {
                    if (task.isSuccessful()) {
                        // Sign in success, update UI with the signed-in user's information
                        Log.d(TAG, "signInWithCredential:success");

                        FirebaseUser user = task.getResult().getUser();
                        // Update UI
                    } else {
                        // Sign in failed, display a message and update the UI
                        Log.w(TAG, "signInWithCredential:failure", task.getException());
                        if (task.getException() instanceof FirebaseAuthInvalidCredentialsException) {
                            // The verification code entered was invalid
                        }
                    }
                }
            });
}

Test with fictional phone numbers

You can phối up fictional phone numbers for development via the Firebase console. Testing with fictional phone numbers provides these benefits:

• Test phone number authentication without consuming your usage quota.
• Test phone number authentication without sending an actual SMS message.
• Run consecutive tests with the same phone number without getting throttled. This minimizes the risk of rejection during App store review process if the reviewer happens to lớn use the same phone number for testing.
• Test readily in development environments without any additional effort, such as the ability to lớn develop in an iOS simulator or an Android emulator without Google Play Services.
• Write integration tests without being blocked by security checks normally applied on real phone numbers in a production environment.

Fictional phone numbers must meet these requirements:

1. Make sure you use phone numbers that are indeed fictional, and tự not already exist. Firebase Authentication does not allow you to lớn phối existing phone numbers used by real users as test numbers. One option is to lớn use 555 prefixed numbers as US test phone numbers, for example: +1 650-555-3434
2. Phone numbers have to lớn be correctly formatted for length and other constraints. They will still go through the same validation as a real user's phone number.
3. You can add up to lớn 10 phone numbers for development.
4. Use test phone numbers/codes that are hard to lớn guess and change those frequently.

Create fictional phone numbers and verification codes

1. In the Firebase console, open the Authentication section.
2. In the Sign in method tab, enable the Phone provider if you haven't already.
3. Open the Phone numbers for testing accordion thực đơn.
4. Provide the phone number you want to lớn test, for example: +1 650-555-3434.
5. Provide the 6-digit verification code for that specific number, for example: 654321.
6. Add the number. If there's a need, you can delete the phone number and its code by hovering over the corresponding row and clicking the trash icon.

Manual testing

You can directly start using a fictional phone number in your application. This allows you to perform manual testing during development stages without running into quota issues or throttling. You can also test directly from an iOS simulator or Android emulator without Google Play Services installed.

When you provide the fictional phone number and send the verification code, no actual SMS is sent. Instead, you need to lớn provide the previously configured verification code to lớn complete the sign in.

On sign-in completion, a Firebase user is created with that phone number. The user has the same behavior and properties as a real phone number user, and can access Realtime Database/Cloud Firestore and other services the same way. The ID token minted during this process has the same signature as a real phone number user.

Another option is to lớn phối a test role via custom claims on these users to lớn differentiate them as fake users if you want to lớn further restrict access.

To manually trigger the reCAPTCHA flow for testing, use the forceRecaptchaFlowForTesting() method.

// Force reCAPTCHA flow
FirebaseAuth.getInstance().getFirebaseAuthSettings().forceRecaptchaFlowForTesting();

Integration testing

In addition to lớn manual testing, Firebase Authentication provides APIs to lớn help write integration tests for phone auth testing. These APIs disable phầm mềm verification by disabling the reCAPTCHA requirement in trang web and silent push notifications in iOS. This makes automation testing possible in these flows and easier to lớn implement. In addition, they help provide the ability to lớn test instant verification flows on Android.

On Android, Hotline setAppVerificationDisabledForTesting() before the signInWithPhoneNumber Hotline. This disables phầm mềm verification automatically, allowing you to lớn pass the phone number without manually solving it. Even though Play Integrity and reCAPTCHA are disabled, using a real phone number will still fail to complete sign in. Only fictional phone numbers can be used with this API.

// Turn off phone auth phầm mềm verification.
FirebaseAuth.getInstance().getFirebaseAuthSettings()
   .setAppVerificationDisabledForTesting();

Calling verifyPhoneNumber with a fictional number triggers the onCodeSent callback, in which you'll need to lớn provide the corresponding verification code. This allows testing in Android Emulators.

String phoneNum = "+16505554567";
String testVerificationCode = "123456";

// Whenever verification is triggered with the whitelisted number,
// provided it is not phối for auto-retrieval, onCodeSent will be triggered.
FirebaseAuth auth = FirebaseAuth.getInstance();
PhoneAuthOptions options = PhoneAuthOptions.newBuilder(auth)
        .setPhoneNumber(phoneNum)
        .setTimeout(60L, TimeUnit.SECONDS)
        .setActivity(this)
        .setCallbacks(new PhoneAuthProvider.OnVerificationStateChangedCallbacks() {
            @Override
            public void onCodeSent(@NonNull String verificationId,
                                   @NonNull PhoneAuthProvider.ForceResendingToken forceResendingToken) {
                // Save the verification id somewhere
                // ...

                // The corresponding whitelisted code above should be used to lớn complete sign-in.
                MainActivity.this.enableUserManuallyInputCode();
            }

            @Override
            public void onVerificationCompleted(@NonNull PhoneAuthCredential phoneAuthCredential) {
                // Sign in with the credential
                // ...
            }

            @Override
            public void onVerificationFailed(@NonNull FirebaseException e) {
                // ...
            }
        })
        .build();
PhoneAuthProvider.verifyPhoneNumber(options);

val phoneNum = "+16505554567"
val testVerificationCode = "123456"

// Whenever verification is triggered with the whitelisted number,
// provided it is not phối for auto-retrieval, onCodeSent will be triggered.
val options = PhoneAuthOptions.newBuilder(Firebase.auth)
    .setPhoneNumber(phoneNum)
    .setTimeout(30L, TimeUnit.SECONDS)
    .setActivity(this)
    .setCallbacks(object : PhoneAuthProvider.OnVerificationStateChangedCallbacks() {

        override fun onCodeSent(
            verificationId: String,
            forceResendingToken: PhoneAuthProvider.ForceResendingToken,
        ) {
            // Save the verification id somewhere
            // ...

            // The corresponding whitelisted code above should be used to lớn complete sign-in.
            [email protected]()
        }

        override fun onVerificationCompleted(phoneAuthCredential: PhoneAuthCredential) {
            // Sign in with the credential
            // ...
        }

        override fun onVerificationFailed(e: FirebaseException) {
            // ...
        }
    })
    .build()
PhoneAuthProvider.verifyPhoneNumber(options)

Additionally, you can test auto-retrieval flows in Android by setting the fictional number and its corresponding verification code for auto-retrieval by calling setAutoRetrievedSmsCodeForPhoneNumber.

When verifyPhoneNumber is called, it triggers onVerificationCompleted with the PhoneAuthCredential directly. This works only with fictional phone numbers.

Make sure this is disabled and no fictional phone numbers are hardcoded in your phầm mềm when publishing your application to lớn the Google Play store.

// The test phone number and code should be whitelisted in the console.
String phoneNumber = "+16505554567";
String smsCode = "123456";

FirebaseAuth firebaseAuth = FirebaseAuth.getInstance();
FirebaseAuthSettings firebaseAuthSettings = firebaseAuth.getFirebaseAuthSettings();

// Configure faking the auto-retrieval with the whitelisted numbers.
firebaseAuthSettings.setAutoRetrievedSmsCodeForPhoneNumber(phoneNumber, smsCode);

PhoneAuthOptions options = PhoneAuthOptions.newBuilder(firebaseAuth)
        .setPhoneNumber(phoneNumber)
        .setTimeout(60L, TimeUnit.SECONDS)
        .setActivity(this)
        .setCallbacks(new PhoneAuthProvider.OnVerificationStateChangedCallbacks() {
            @Override
            public void onVerificationCompleted(@NonNull PhoneAuthCredential credential) {
                // Instant verification is applied and a credential is directly returned.
                // ...
            }

            // ...
        })
        .build();
PhoneAuthProvider.verifyPhoneNumber(options);

// The test phone number and code should be whitelisted in the console.
val phoneNumber = "+16505554567"
val smsCode = "123456"

val firebaseAuth = Firebase.auth
val firebaseAuthSettings = firebaseAuth.firebaseAuthSettings

// Configure faking the auto-retrieval with the whitelisted numbers.
firebaseAuthSettings.setAutoRetrievedSmsCodeForPhoneNumber(phoneNumber, smsCode)

val options = PhoneAuthOptions.newBuilder(firebaseAuth)
    .setPhoneNumber(phoneNumber)
    .setTimeout(60L, TimeUnit.SECONDS)
    .setActivity(this)
    .setCallbacks(object : PhoneAuthProvider.OnVerificationStateChangedCallbacks() {
        override fun onVerificationCompleted(credential: PhoneAuthCredential) {
            // Instant verification is applied and a credential is directly returned.
            // ...
        }

        // ...
    })
    .build()
PhoneAuthProvider.verifyPhoneNumber(options)

Next steps

After a user signs in for the first time, a new user tài khoản is created and linked to lớn the credentials—that is, the user name and password, phone number, or auth provider information—the user signed in with. This new account is stored as part of your Firebase project, and can be used to lớn identify a user across every phầm mềm in your project, regardless of how the user signs in.

• In your apps, you can get the user's basic profile information from the FirebaseUser object. See Manage Users.

• In your Firebase Realtime Database and Cloud Storage Security Rules, you can get the signed-in user's unique user ID from the auth variable, and use it to lớn control what data a user can access.

You can allow users to lớn sign in to lớn your phầm mềm using multiple authentication providers by linking auth provider credentials to lớn an existing user tài khoản.

To sign out a user, Hotline signOut:

Xem thêm: từ cực bắc của trái đất

Firebase.auth.signOut()

FirebaseAuth.getInstance().signOut();