{"post":{"slug":"how-to-set-up-firebase-2026","title":"How to set up Firebase in 2026","excerpt":"Firebase in 2026 means Modular SDK v10+, Firestore Security Rules, and App Check. This guide covers project init, Firestore, Auth, and production hardening.","category":"code","date":"February 26, 2026","author":"ByteLedger Team","content":"<span class=\"dropcap\">F</span>irebase remains one of the quickest paths to a production-grade backend in 2026 — Firestore, Auth, Storage, and Cloud Functions under one project umbrella. The Modular SDK (v10+) completed the shift to tree-shakeable, function-based imports, and the Emulator Suite makes local development safe and fast. This guide gets a new project to a secure, production-ready baseline.\n\n## What changed in 2026\n\n- **Modular SDK v10** is the only recommended path; the `compat` layer is in maintenance mode.\n- **App Check is effectively required** for any public app — it verifies client authenticity using device attestation (reCAPTCHA v3, Play Integrity, App Attest).\n- **Firestore Data Connect (preview)** is a GraphQL-over-Firestore layer aimed at enterprise use — interesting to watch, not yet the default.\n- **Firebase Extensions catalog** has grown; many common patterns (email triggers, image resizing) are one-click installs.\n\n## Project setup\n\n```bash\nnpm install -g firebase-tools\nfirebase login\nfirebase init\n```\n\n`firebase init` prompts you to pick services (Firestore, Functions, Hosting, etc.), sets up `firebase.json`, and downloads emulator binaries. Select \"Emulators\" to enable local testing.\n\nInstall the SDK:\n\n```bash\nnpm install firebase\n```\n\nInitialize in code:\n\n```js\nimport { initializeApp } from 'firebase/app';\nimport { getFirestore } from 'firebase/firestore';\nimport { getAuth } from 'firebase/auth';\n\nconst app = initializeApp({\n  apiKey: process.env.NEXT_PUBLIC_FIREBASE_API_KEY,\n  authDomain: process.env.NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN,\n  projectId: process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID,\n});\n\nexport const db = getFirestore(app);\nexport const auth = getAuth(app);\n```\n\n## Connecting to the Emulator Suite\n\n```js\nimport { connectFirestoreEmulator } from 'firebase/firestore';\nimport { connectAuthEmulator } from 'firebase/auth';\n\nif (process.env.NODE_ENV === 'development') {\n  connectFirestoreEmulator(db, 'localhost', 8080);\n  connectAuthEmulator(auth, 'http://localhost:9099');\n}\n```\n\nStart emulators with `firebase emulators:start`. The Emulator UI at `localhost:4000` lets you browse data, trigger auth events, and inspect function logs.\n\n## Firestore CRUD with the Modular SDK\n\n```js\nimport { collection, addDoc, getDocs, query, where, orderBy } from 'firebase/firestore';\n\n// Write\nconst docRef = await addDoc(collection(db, 'posts'), {\n  title: 'Hello',\n  authorId: auth.currentUser.uid,\n  createdAt: serverTimestamp(),\n});\n\n// Read with a filter\nconst q = query(\n  collection(db, 'posts'),\n  where('authorId', '==', auth.currentUser.uid),\n  orderBy('createdAt', 'desc'),\n);\nconst snapshot = await getDocs(q);\nconst posts = snapshot.docs.map((d) => ({ id: d.id, ...d.data() }));\n```\n\n## Firestore Security Rules\n\n```\nrules_version = '2';\nservice cloud.firestore {\n  match /databases/{database}/documents {\n    match /posts/{postId} {\n      allow read: if request.auth != null;\n      allow create: if request.auth.uid == request.resource.data.authorId;\n      allow update, delete: if request.auth.uid == resource.data.authorId;\n    }\n  }\n}\n```\n\nDeploy rules: `firebase deploy --only firestore:rules`. Test rules locally with the Emulator or the Rules Playground in the Firebase console.\n\n## Firebase vs Supabase (2026)\n\n| Dimension | Firebase | Supabase |\n|---|---|---|\n| Database model | NoSQL (Firestore) | Relational (Postgres) |\n| Offline sync | Native (Firestore) | Via Realtime (limited) |\n| SQL queries | No | Full SQL |\n| Self-host | No | Yes |\n| Mobile SDKs | Excellent (iOS, Android) | Good, improving |\n| Serverless functions | Cloud Functions (Node/Python) | Edge Functions (Deno) |\n\n## How to start\n\n1. Create a project at [console.firebase.google.com](https://console.firebase.google.com).\n2. `firebase init` — select Firestore, Auth, Emulators at minimum.\n3. Write Security Rules before any production data lands.\n4. Enable App Check under \"App Check\" in the console.\n5. Use Modular SDK imports throughout; avoid the `compat` path.\n\n## Common mistakes\n\n**Opening Firestore with `allow read, write: if true;`** during prototyping and forgetting to lock it down. Use `if request.auth != null` as the minimum and ship proper rules before launch.\n\n**Querying without indexes.** Compound queries (`where` + `orderBy` on different fields) require composite indexes. The Firestore emulator logs the index-creation link when it detects a missing index.\n\n**Bundling the full Firebase SDK.** With the Modular SDK, import only `firebase/firestore` and `firebase/auth`, not `firebase/app` + everything. Bundle analyzers expose over-imports quickly.\n\n**Not testing Security Rules.** The `firebase-admin` test helper (`@firebase/rules-unit-testing`) lets you assert that rules block what they should — write at least a few unit tests.\n\n## What to skip\n\n- **The Realtime Database** — Firestore supersedes it for new projects; RTDB lacks Security Rules parity and has a different data model.\n- **Firebase Hosting for server-rendered apps** — it suits static sites and SPAs; for SSR at scale, Cloud Run or another container host is more flexible.\n- **Compat imports** — `import firebase from 'firebase/compat/app'` brings the full legacy bundle; switch to modular imports.\n\n## FAQ\n\n**Is the Firebase API key a secret?**\nNo — it is a public project identifier. Security comes from Firestore/Storage Security Rules and App Check, not from keeping the key private.\n\n**How do I handle server-side Firebase in Node.js?**\nUse the `firebase-admin` SDK with a service account JSON. It bypasses Security Rules (intentionally), so scope what server code does carefully.\n\n**How do I paginate large Firestore collections?**\nUse `startAfter(lastDoc)` with a `limit()` clause — cursor-based pagination. Offset pagination is not natively supported in Firestore.\n\n**Can I use Firebase Auth with a custom backend?**\nYes — verify the Firebase ID token server-side with `admin.auth().verifyIdToken(token)`. The decoded token includes `uid` and custom claims.\n\n## Where to go next\n\n- [How to set up Supabase in 2026](/blog/how-to-set-up-supabase-2026)\n- [How to add authentication to an app in 2026](/blog/how-to-add-authentication-to-an-app-2026)\n- [How to set up Redis caching in 2026](/blog/how-to-set-up-redis-caching-2026)","hue":309,"metaTitle":"How to Set Up Firebase in 2026 (Modular SDK + Rules)","metaDescription":"Set up Firebase in 2026 with the Modular SDK v10, Firestore Security Rules, App Check, and the Emulator Suite. Covers Auth, Firestore","keywords":["how to set up firebase 2026","firebase modular sdk v10","firestore security rules 2026","firebase app check","firebase emulator suite","firebase auth setup","firebase firestore tutorial","firebase js sdk 2026","firebase project setup","firebase production hardening"],"tldr":["**Use the Modular SDK (v10+)** — tree-shakeable, function-based imports; the legacy compat layer adds ~40 KB to your bundle for no gain.","**Write Firestore Security Rules before you launch** — by default, newly created projects deny all; rules are your primary access control layer.","**Enable App Check** — it ties your backend to your legitimate app instances, blocking unauthorized API calls with near-zero effort.","**Use Firebase Emulator Suite for local dev** — full local emulation of Firestore, Auth, Functions, and Storage; no production writes during development.","**Skip:** putting Firebase config with API keys in `.env.secret` files — the Firebase API key is a public identifier, not a secret; security comes from Security Rules."],"readTime":"4 min read","wordCount":852},"related":[{"slug":"how-to-set-up-supabase-2026","title":"How to set up Supabase in 2026","excerpt":"Supabase is a Postgres-backed BaaS with auth, storage, and realtime built in. This guide covers project setup, Row Level Security, and the JS client in 2026.","category":"code","date":"April 18, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":308},{"slug":"supabase-vs-firebase-2026","title":"Supabase vs Firebase in 2026: pricing, lock-in, and the real comparison","excerpt":"Supabase and Firebase compared in 2026. Pricing, vendor lock-in, real-time, auth, and which backend fits your app.","category":"code","date":"January 21, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":305},{"slug":"how-to-learn-fastapi-2026","title":"How to learn FastAPI in 2026: async Python APIs with Pydantic and OpenAPI","excerpt":"FastAPI is the fastest-growing Python web framework and the default choice for async APIs in 2026. This guide gives you a direct, practical path to production-ready FastAPI.","category":"code","date":"April 16, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":313}],"sameCategory":[{"slug":"bazel-build-explained-2026","title":"Bazel Explained: What Hermetic Builds Actually Cost","excerpt":"Bazel delivers reproducible, precisely cached builds and demands that you describe everything. Here is what you get, what it costs, and who should say no.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":145},{"slug":"graphql-federation-2026","title":"GraphQL Federation: One Graph, Many Teams","excerpt":"Federation composes independently-owned subgraphs into a single API. Here is what it solves, the operational cost it adds, and when a simpler gateway is enough.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":300},{"slug":"hermetic-builds-explained-2026","title":"Hermetic Builds Explained: Same Inputs, Same Output","excerpt":"A hermetic build depends only on declared inputs. Here is what that property gives you, the common leaks that break it, and how to move toward it incrementally.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":130},{"slug":"monorepo-tooling-compared-2026","title":"Monorepo Tooling Compared: What You Actually Need","excerpt":"Monorepo tools solve task orchestration and caching, not repository layout. Here is what each tier provides and how to tell when you have outgrown the simple option.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":150}],"newer":{"slug":"how-to-set-up-dual-monitors-2026","title":"How to set up dual monitors in 2026: cables, settings, and getting it right","excerpt":"Dual monitors nearly double usable screen space and pay back the setup time in a week. Here is the exact process for 2026 hardware and OS settings.","category":"tech","date":"February 26, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":234},"older":{"slug":"how-to-learn-c-2026","title":"How to learn C in 2026: the practical path from zero to systems programmer","excerpt":"C is still the language under nearly every operating system, embedded device, and performance-critical library. Here is the fastest honest path to real C fluency in 2026.","category":"code","date":"February 25, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":305}}