Firebase Authentication
Google's managed authentication for web and mobile apps — email/password, social logins, phone auth, and anonymous auth with SDKs for every platform and deep Firebase ecosystem integration.
Use Cases
Free Tier
Spark (no-cost) plan: 50,000 monthly active users free indefinitely — no credit card required
How to Maximize the Free Tier
The Spark plan's 50K MAU free tier is one of the most generous in auth — most bootstrapped apps never hit it. MAU counts anyone who authenticates in a calendar month, and returning users re-count each month, so an app with 30K signups that all come back monthly uses 30K MAU, not 90K. Watch the gotchas: Phone Auth is NOT on Spark (SMS is billed per message on Blaze), so stick to email/password + social providers to stay at $0. Combining with the rest of Firebase's free tier makes a full backend: Firestore (1GB storage, 50K reads/day), Hosting (10GB storage, SSL), and Cloud Functions. If you later enable billing, the 50K MAU free tier carries over to Blaze and you get the $300 trial credit. Use the prebuilt FirebaseUI or the email link (passwordless) sign-in to cut UI work further.
Getting Started
Go to console.firebase.google.com → create a project → open Authentication → Get Started → enable sign-in methods (Email/Password, Google, GitHub, etc.) → add your app (web: copy the config object) → install the SDK (npm i firebase) → initialize with your config → call createUserWithEmailAndPassword or signInWithPopup → watch onAuthStateChanged for session state. For a hosted UI, drop in FirebaseUI and point it at your providers.
Pros
- Free tier: 50K MAU free forever on Spark with no payment method — extremely generous for indie hackers
- Provider coverage: Email/password, Google, GitHub, Apple, phone, anonymous, and custom tokens out of the box
- Ecosystem: Works with Firestore, Hosting, and Cloud Functions — a fully free backend in one console
Cons
- Phone auth cost: Phone authentication is excluded from Spark — SMS is billed per message once you enable billing
- Vendor lock-in: Deep Google integration makes migrating users and flows to another provider nontrivial
- Limited customization: Password policies and the hosted UI are less configurable than dedicated CIAM platforms