Firebase setup
your own project.

01Create the project

1. Create a Firebase projectIn the Firebase console, add a project. Remember its project id.
2. Upgrade to BlazeCloud Functions, Cloud Scheduler and calls to the ad networks and stores only work on the Blaze (pay-as-you-go) plan. Set a budget alert in Google Cloud Billing. Required
3. Enable AuthenticationBuild → Authentication → Sign-in method. Enable Anonymous (the "Continue as guest" button), Google and Apple. The app signs in with these three and lets a guest link Google or Apple later (app/lib/data/firebase_backend.dart).
4. Create FirestoreBuild → Firestore Database, Native mode. Pick a location close to your users.

02Point the backend at your project

firebase/.firebaserc ships with demo-watchandearn, an emulator-only id. Replace it with yours:

cd firebase
firebase login
firebase use --add   # pick your project; or edit .firebaserc by hand

03Choose the Functions region

Functions deploy to us-central1 by default (firebase/functions/src/index.ts). To use another region, create firebase/functions/.env from the example and set it:

cd firebase/functions
cp .env.example .env   # then edit FUNCTIONS_REGION, e.g. europe-west1

If you change the region, use the same one in three places: the app build (--dart-define=FUNCTIONS_REGION=…, see Build switches), the console's Backend → Cloud Functions base URL, and every callback URL you give to ad networks and partners.

This file holds no secrets. Ad network secrets and store keys are entered in the console and stored in the Firestore document config/private, which no app can read.

04Deploy rules, indexes and functions

cd firebase/functions && npm ci && cd ..
firebase deploy --only firestore:rules,firestore:indexes,functions

The deploy builds the TypeScript first (predeploy in firebase/firebase.json). At the end it prints the URLs of the HTTP functions (ssvAdmob, ssvUnity, ssvIronsource, offerPostback, owAdgem, owLootably, owBitlabs, owCpx, paypalWebhook); you also find them in Firebase console → Functions. Building the indexes can take a few minutes.

The deploy also creates the scheduled jobs (Cloud Scheduler) and the Firestore triggers (firebase/README.md §9):

05Connect the app (flutterfire configure)

app/lib/firebase_options.dart is a placeholder with empty values. While it is empty the app shows a setup screen. Replace it:

dart pub global activate flutterfire_cli
cd app
flutterfire configure   # choose your project and the android, ios and web platforms

Run it again after you change the application id or bundle id (see Rebranding), so the Firebase apps match the new ids.

06App Check

Every callable function refuses calls without a valid App Check token in production (firebase/functions/src/guard.ts). The app activates App Check on Android and iOS (app/lib/core/firebase_setup.dart): Play Integrity on Android, App Attest with DeviceCheck fallback on iOS, and the debug provider in debug builds.

1. Register the appsFirebase console → App Check → Apps. Register the Android app with Play Integrity and the iOS app with App Attest (and DeviceCheck).
2. Add debug tokens for developmentA debug build prints a debug token in the device log the first time it starts. Add it in Firebase console → App Check → Apps → your app → Manage debug tokens. Without it a debug build gets permission-denied or unauthenticated errors.
3. Enforce for FirestoreApp Check → APIs → Cloud Firestore → Enforce.
4. While wiring upYou may set ENFORCE_APP_CHECK=false in firebase/functions/.env and redeploy. Turn it back to true before release. The emulator never enforces App Check.

07Indexes and rules

firebase/firestore.indexes.json holds the composite indexes (ad-session expiry, open fraud flags, push campaigns, events, the review queue, redemptions, revenue events by source and offerwall conversions, payout requests by user, status and method, conversions by user, and wallet entries by state and release time) and the collection-group overrides the console and account deletion need (ledger.createdAt descending, daily.day, leaderboard entries.points and entries.uid, friends.uid). firebase/firestore.rules lets a user read only their own data and change only their displayName, settings, equipped cosmetics they own and the read mark of their inbox items. Points, ledger, streaks, leaderboards and everything that credits are written only by the server. Since 4.0 a user can also read their own wallet, wallet entries and payout requests, and never write them; payoutDestinations, payoutEvents and config/private are closed to clients.

08Check it worked

• Firebase console → Functions lists ensureProfile, requestAdSession, ssvAdmob, owAdgem and the other functions in your region
• Firestore → Indexes shows every index as Enabled
• After the console started once, Firestore has config/public and config/private
• The app starts past the setup screen and "Continue as guest" works