---
name: android-firebase-bom
description: "Wire Firebase right — Auth, Firestore, Realtime DB, Crashlytics, Analytics, Cloud Messaging — via the BoM. Production Firebase setup using the Firebase BoM (Bill of Materials) so versions stay aligned. Covers Auth (Google/Apple/Phone), Firestore offline persistence, Crashlytics + ANR + custom keys, FCM push notifications, and Remote Config patterns."
license: MIT
---

# Android Firebase BoM

A setup guide and code-generation skill for wiring Firebase into an Android app the right way, anchored on the Firebase **Bill of Materials (BoM)** so every library version stays compatible. It targets Android engineers who are adding Auth, Firestore, Crashlytics, Analytics, Cloud Messaging, or Remote Config to a Gradle project and want production-grade defaults instead of copy-pasted snippets that drift out of sync.

## When to use it

- Starting Firebase from scratch and unsure which dependencies and plugins belong where.
- Chasing `NoClassDefFoundError` or version-skew crashes after manually pinning Firebase library versions.
- Adding sign-in (Google One Tap, Apple via OAuth provider, or phone/SMS) and need the verification flow handled correctly.
- Turning on Crashlytics with ANR reporting, custom keys, and NDK symbol upload.
- Standing up FCM push with a proper `FirebaseMessagingService` and token refresh handling.

## What it does

Generates and explains the wiring across the files that matter:

- **Gradle**: applies `com.google.gms.google-services` and `com.google.firebase.crashlytics` plugins, then imports `platform("com.google.firebase:firebase-bom:<version>")` so you declare artifacts like `firebase-firestore`, `firebase-auth`, `firebase-analytics`, `firebase-messaging`, and `firebase-config` **without version numbers**.
- **Auth**: `FirebaseAuth`, `GoogleAuthProvider.getCredential()` with Credential Manager, `OAuthProvider` for Apple, and `PhoneAuthProvider.verifyPhoneNumber()` with `PhoneAuthOptions`.
- **Firestore**: enables offline persistence via `FirebaseFirestoreSettings` / `PersistentCacheSettings`, plus snapshot listeners and `Source.CACHE` patterns.
- **Crashlytics**: `setCustomKey`, `setUserId`, `recordException`, ANR collection, and `firebaseCrashlytics { mappingFileUploadEnabled }`.
- **FCM**: a `FirebaseMessagingService` subclass overriding `onMessageReceived` and `onNewToken`, plus the `POST_NOTIFICATIONS` runtime permission for Android 13+.
- **Remote Config**: `setConfigSettingsAsync`, `setDefaultsAsync`, and `fetchAndActivate()`.

## Usage example

```kotlin
// app/build.gradle.kts
plugins {
    id("com.google.gms.google-services")
    id("com.google.firebase.crashlytics")
}

dependencies {
    implementation(platform("com.google.firebase:firebase-bom:33.7.0"))
    implementation("com.google.firebase:firebase-analytics")
    implementation("com.google.firebase:firebase-auth")
    implementation("com.google.firebase:firebase-firestore")
    implementation("com.google.firebase:firebase-messaging")
}
```

## Tips & gotchas

- Never mix BoM-managed and explicitly versioned Firebase artifacts — pinning one forces you to track the whole matrix manually, which defeats the BoM.
- `google-services.json` must sit in the **module** directory (`app/`), and its `package_name` must match your `applicationId`, including build-type suffixes.
- Crashlytics reports only after a process restart; force a `throw RuntimeException()` in debug to confirm the pipeline before assuming silence means success.
- On Android 13+, an FCM token alone won't show notifications — you must request `POST_NOTIFICATIONS` at runtime.

## FAQ

**Do I still need `firebase-analytics` if I don't use Analytics?**
It's recommended; several products (including Crashlytics and Remote Config) lean on it for breadcrumb and audience data, and it's lightweight.

**Why did versions stop appearing in my dependency block?**
That's intentional — the BoM resolves them. Check the BoM version's release notes to see what each artifact maps to.

**Does the BoM cover Google Play services libraries like Maps?**
No. The Firebase BoM governs only `com.google.firebase:*` artifacts; Play services dependencies are versioned separately.