Technical reference

Firebase Cheatsheet

Managed auth, data, messaging, and analytics

Must Know

javascript

Initialize App

Firebase client config is public; security comes from rules.

const app = initializeApp(firebaseConfig);
const auth = getAuth(app);
const db = getFirestore(app);

javascript

Firestore Read

const snapshot = await getDoc(doc(db, 'users', userId));
if (snapshot.exists()) console.log(snapshot.data());

Important Patterns

javascript

Security Rules

Default-deny and test rules with the emulator.

match /users/{userId} {
  allow read, update: if request.auth != null && request.auth.uid == userId;
}

javascript

Transaction

Transactions may retry; keep callbacks free of side effects.

await runTransaction(db, async tx => {
  const snap = await tx.get(ref);
  tx.update(ref, { count: snap.data().count + 1 });
});

Useful Recipes

javascript

Realtime Listener

const unsubscribe = onSnapshot(queryRef, snapshot => {
  items.value = snapshot.docs.map(doc => ({ id: doc.id, ...doc.data() }));
});
// call unsubscribe on cleanup

bash

Local Emulator

Develop and test without touching production.

firebase emulators:start
FIRESTORE_EMULATOR_HOST=127.0.0.1:8080
FIREBASE_AUTH_EMULATOR_HOST=127.0.0.1:9099

Pitfalls & Production

Query and Cost

Model data around access and cost.

read cost is per document
indexes support query shapes
listeners can create ongoing reads
avoid unbounded collections

Admin SDK

Never bundle admin credentials in a client.

// Server only: Admin SDK bypasses Firestore security rules.
// Authenticate and authorize before every privileged operation.