Android Firebase BoM

A setup guide and code-generation skill for wiring Firebase into an Android app the right way, anchored on the Firebase Bill of Materials (BoM) so every library version stays compatible. It targets Android engineers who are adding Auth, Firestore, Crashlytics, Analytics, Cloud Messaging, or Remote Config to a Gradle project and want production-grade defaults instead of copy-pasted snippets that drift out of sync.

When to use it

• Starting Firebase from scratch and unsure which dependencies and plugins belong where.
• Chasing NoClassDefFoundError or version-skew crashes after manually pinning Firebase library versions.
• Adding sign-in (Google One Tap, Apple via OAuth provider, or phone/SMS) and need the verification flow handled correctly.
• Turning on Crashlytics with ANR reporting, custom keys, and NDK symbol upload.
• Standing up FCM push with a proper FirebaseMessagingService and token refresh handling.

What it does

Generates and explains the wiring across the files that matter:

• Gradle: applies com.google.gms.google-services and com.google.firebase.crashlytics plugins, then imports platform("com.google.firebase:firebase-bom:<version>") so you declare artifacts like firebase-firestore, firebase-auth, firebase-analytics, firebase-messaging, and firebase-config without version numbers.
• Auth: FirebaseAuth, GoogleAuthProvider.getCredential() with Credential Manager, OAuthProvider for Apple, and PhoneAuthProvider.verifyPhoneNumber() with PhoneAuthOptions.
• Firestore: enables offline persistence via FirebaseFirestoreSettings / PersistentCacheSettings, plus snapshot listeners and Source.CACHE patterns.
• Crashlytics: setCustomKey, setUserId, recordException, ANR collection, and firebaseCrashlytics { mappingFileUploadEnabled }.
• FCM: a FirebaseMessagingService subclass overriding onMessageReceived and onNewToken, plus the POST_NOTIFICATIONS runtime permission for Android 13+.
• Remote Config: setConfigSettingsAsync, setDefaultsAsync, and fetchAndActivate().

Usage example

curl -fsSL --create-dirs -o ~/.claude/skills/android-firebase-bom/SKILL.md https://claudeskil.com/skills/android-firebase-bom/SKILL.md

// app/build.gradle.kts
plugins {
    id("com.google.gms.google-services")
    id("com.google.firebase.crashlytics")
}

dependencies {
    implementation(platform("com.google.firebase:firebase-bom:33.7.0"))
    implementation("com.google.firebase:firebase-analytics")
    implementation("com.google.firebase:firebase-auth")
    implementation("com.google.firebase:firebase-firestore")
    implementation("com.google.firebase:firebase-messaging")
}

Tips & gotchas

• Never mix BoM-managed and explicitly versioned Firebase artifacts — pinning one forces you to track the whole matrix manually, which defeats the BoM.
• google-services.json must sit in the module directory (app/), and its package_name must match your applicationId, including build-type suffixes.
• Crashlytics reports only after a process restart; force a throw RuntimeException() in debug to confirm the pipeline before assuming silence means success.
• On Android 13+, an FCM token alone won't show notifications — you must request POST_NOTIFICATIONS at runtime.

FAQ

Do I still need firebase-analytics if I don't use Analytics? It's recommended; several products (including Crashlytics and Remote Config) lean on it for breadcrumb and audience data, and it's lightweight.

Why did versions stop appearing in my dependency block? That's intentional — the BoM resolves them. Check the BoM version's release notes to see what each artifact maps to.

Does the BoM cover Google Play services libraries like Maps? No. The Firebase BoM governs only com.google.firebase:* artifacts; Play services dependencies are versioned separately.