Firebase gives a Flutter app authentication, Firestore, storage, cloud functions, crash reporting, and analytics under one Google account. It is the incumbent choice and the free tier is generous.
Authentication with 12+ providers built in. Firestore for document data. Cloud Storage for files. Cloud Functions for backend logic. Crashlytics for crashes. Analytics via GA4. Cloud Messaging for push. One SDK per module: firebase_auth, cloud_firestore, firebase_storage, cloud_functions, firebase_crashlytics.
Enable email/password. Enable Sign in with Apple (required by App Store Guideline 4.8 if you offer any third-party sign-in). Configure account deletion — an in-app path is required. Enable email verification and password reset.
Rules live in firestore.rules and are evaluated on every request. A minimal per-user rule: match /users/{uid}/data/{doc} { allow read, write: if request.auth.uid == uid; }. Test rules with the emulator before deploying — an over-permissive rule leaks every user's data.
Anything security-sensitive (server-side purchase validation, admin operations, third-party API calls with secret keys) belongs in Cloud Functions. Deploy them alongside your rules; they run under a service account, not the caller's auth.
Firebase Crashlytics for Flutter captures native crashes and Dart exceptions with symbolication. High ANR rates on Play get an app delisted; Crashlytics tells you before Play does.
ML Kit, App Distribution (unless you have testers), Dynamic Links (deprecated 2025), Remote Config (nice-to-have), Test Lab (nice-to-have). Start with Auth + Firestore + Storage + Crashlytics.
Official documentation this page is grounded in. Verified to resolve.