September 2026 Summaries

Firebase Phone Number Verification (PNV) is a carrier-based authentication service designed to replace SMS one-time passwords with a consent-based flow that reduces phishing risk and avoids requiring users to manually enter their phone numbers. It can verify numbers through an internet connection even when mobile data is disabled or a device is in airplane mode, and it has expanded production support to 10 additional networks, including Tune Talk and U Mobile in Malaysia, MasOrange in Spain, PTML in Pakistan, and Vodafone networks across six European countries. The service is now available through multiple carriers in Finland, France, Germany, Greece, Indonesia, Ireland, Malaysia, the Netherlands, Pakistan, Romania, Spain, and the United Kingdom. Developers can try the experience without billing, a supported SIM, or production onboarding through SIM-less test mode, which can generate a test token shortly after project creation and uses the same implementation methods as production.

Firebase’s agent plugin is now available in the Codex plugin directory, giving Codex access to Firebase agent skills, the Firebase MCP server, and the Firebase CLI for application development, project management, real-time data operations, and deployment tasks. The plugin enables prompt-driven setup of Firebase projects, Firestore databases, Authentication, SDK configuration, and starter Security Rules while applying Firebase-recommended architecture and security practices. Codex can initially build and preview an app locally with placeholder configurations before provisioning a live Firebase backend, then help users inspect both the codebase and Firebase console settings. For production preparation, the plugin can audit generated Security Rules to identify concerns such as unbounded database costs and risks associated with anonymous authentication, and it can propose or implement mitigations such as Google Sign-In and account linking to preserve user data. By packaging related skills and tools into one integration, the plugin aims to simplify using Firebase within Codex and support more secure, streamlined AI-assisted development workflows.

Firebase has introduced spend caps in Public Preview to help developers limit costs for eligible services including Firebase AI Logic, Cloud Functions for Firebase, and Firebase App Hosting. Configured through the Firebase console’s Accounts & budgets section, caps can be set per service and issue email notifications at 50%, 80%, and 100% of the selected budget before pausing the affected service once the limit is reached. Developers can also use the Google Cloud console for more advanced budget settings and to lift caps, though paused services may require up to an hour to resume. Spend caps are not instantaneous hard limits because usage-reporting delays may allow several minutes of additional billable consumption, and their calculations use gross standard pricing before credits, free tiers, and discounts, so users are advised to set budgets below their absolute spending limits.

Gemini text-to-speech models, available through Firebase AI Logic, let mobile and web apps generate and stream natural, customizable audio directly to client devices, reducing latency and avoiding server-side audio pipelines. Suggested applications include interactive language-learning conversations, hands-free reading of recipes or guides, accessibility features and spoken summaries, expressive storytelling, and multi-speaker podcasts or dialogue simulations. Built on a large language model, Gemini TTS can interpret both content and delivery, with controls for voice identity, environment, mood, accent, pacing, speaking style, and language, including more than 30 multilingual voices and dynamic language switching. The service produces continuous PCM audio streams for immediate playback and is supported across Swift, Kotlin, Java, JavaScript, Dart, and Unity, enabling developers to add context-aware voice features through Firebase AI Logic.

Firebase Authentication and Cloud Firestore can support e-commerce carts without requiring visitors to register before shopping by assigning each visitor an anonymous, cryptographically verified Firebase identity and storing cart items under UID-scoped Firestore paths. Security Rules restrict users to their own carts, permit only validated quantity fields, prevent client-side price manipulation, and require order-history queries to explicitly filter by the authenticated owner because rules do not filter query results. When guests create new accounts, credentials can be linked while retaining the same UID and cart, while returning users require deterministic cart reconciliation into their existing account with bounded quantities. Confirmed orders should be created only by a trusted Cloud Run backend or Firebase Callable Function, which verifies Firebase ID tokens, obtains canonical product prices, calculates totals server-side, writes immutable order records with administrative privileges, and clears carts after checkout.