Firebase phone login with ChinqIT

With a small server, ChinqIT sends and checks the SMS code, then Firebase signs the user in.

How it works

The app sends the phone number to your server, which asks ChinqIT for a code (POST /api/v2/code).
The user receives the SMS and enters the code in the app.
Your server checks the code with ChinqIT (POST /api/v2/check).
If the code is right, the server returns a Firebase token and the app signs the user in.

Server

Install express and firebase-admin, then set CHINQIT_API_KEY in the server environment.

Send the number as +222XXXXXXXX.

import express from 'express'
import admin from 'firebase-admin'

admin.initializeApp()
const app = express()
app.use(express.json())

const API = 'https://sms.chinqit.com/api/v2'
const call = (path, body) =>
  fetch(`${API}/${path}`, {
    method: 'POST',
    headers: { 'X-API-Key': process.env.CHINQIT_API_KEY, 'Content-Type': 'application/json' },
    body: JSON.stringify(body),
  })

app.post('/login/send-code', async (req, res) => {
  const r = await call('code', { phoneNumber: req.body.phoneNumber, channel: 'sms', language: 'en' })
  res.status(r.status).json(await r.json())
})

app.post('/login/verify', async (req, res) => {
  const { phoneNumber, otp } = req.body
  const r = await call('check', { phoneNumber, otp, channel: 'sms' })
  const result = await r.json()
  if (!r.ok || !result.verified) return res.status(r.status).json(result)

  let user
  try {
    user = await admin.auth().getUserByPhoneNumber(phoneNumber)
  } catch (e) {
    if (e.code !== 'auth/user-not-found') throw e
    user = await admin.auth().createUser({ phoneNumber })
  }
  res.json({ token: await admin.auth().createCustomToken(user.uid) })
})

app.listen(3000)

App (JavaScript)

import { getAuth, signInWithCustomToken } from 'firebase/auth'

const { token } = await fetch('/login/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ phoneNumber: '+22238089336', otp: '123456' }),
}).then((r) => r.json())

await signInWithCustomToken(getAuth(), token)

App (Flutter)

await FirebaseAuth.instance.signInWithCustomToken(token);

Android

To fill in the code automatically, see the SMS Retriever Guide.