Do it yourself
$109 per platform, one-time
The WebViewGold license: a finished Xcode or Android Studio project. Paste your URL, set name and icon, switch on features, build and submit. Free updates forever.
See plans on the main page1. Sign-in: popup, redirect or helper?
Most generated Firebase code calls signInWithPopup. In a desktop browser that opens a second window and hands the result back; inside a WKWebView or Android WebView the popup has no reliable way to return, so logins hang. Switch the app flow to signInWithRedirect and handle getRedirectResult on load.
Redirect sign-in has its own catch on Apple platforms: WebKit blocks third-party storage, so the default authDomain (yourproject.firebaseapp.com) can lose the session during the round trip. Firebase's recommended fix is to use your own domain as authDomain: host the app on Firebase Hosting under your custom domain so /__/auth/handler is same-origin, and add that domain under Authentication → Settings → Authorized domains. Then set the same domain as the start URL in WebViewGold.
Google as a provider adds the known WebView block ("disallowed_useragent"). WebViewGold's Social Login Helper solves it: set google_login_helper_triggers in Config.swift and GOOGLE_LOGIN_HELPER_TRIGGERS in Config.java to the accounts.google.com prefixes. Email/password and email-link sign-in need none of this.
2. Apple provider (Guideline 4.8)
Required as soon as Google, Facebook or another third-party login is offered.
Apple Developer portal
Enable Sign in with Apple on your App ID, create a Services ID with your authDomain as the website and https://YOUR-AUTH-DOMAIN/__/auth/handler as the return URL, and create a Sign in with Apple key (.p8).
Firebase console
Authentication → Sign-in method → Apple: enter the Services ID, Apple Team ID, Key ID and the private key. Firebase generates the client secret for you, so there is no six-month renewal chore as with some other backends.
Web app code
const provider = new OAuthProvider("apple.com"); provider.addScope("email"); provider.addScope("name"); signInWithRedirect(auth, provider). Give the Apple button the same visual weight as Google.
Nothing to configure in WebViewGold
The appleid.apple.com flow is detected and handled automatically. Test on a real iPhone via TestFlight; the Simulator is not a reliable judge of OAuth redirects.
3. User data deletion
Both stores require that users can delete their account from inside the app, and Google additionally wants a web page for deletion requests.
- Install the official "Delete User Data" Firebase Extension. It removes the user's documents, Realtime Database nodes and Storage files at the paths you configure whenever an Auth user is deleted.
- In-app button: call
deleteUser(auth.currentUser). Firebase requires a recent login for this, so reauthenticate first (password prompt or a fresh OAuth redirect) and handle theauth/requires-recent-loginerror gracefully. - Alternative for complex data: a callable Cloud Function that uses the Admin SDK to delete data across collections and then
auth().deleteUser(uid); the extension still cleans up what you configured. - Public page /delete-account on your domain explaining the in-app flow and offering a contact form; paste the URL into the Play Console Data safety form and mention deletion in your privacy policy.
Great work! Never coded anything but managed to work with this. Easy and fast! Also with great help from the creators!
4. Firestore rules that pass a reviewer and a hacker
Generated projects often start with test-mode rules that allow everything for 30 days. Firebase emails you when they are about to expire, and the app then breaks in production. Replace them with owner-only rules before submission; here is a minimal, common shape.
javascript
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
// Each user owns exactly one profile document
match /users/{uid} {
allow read, write: if request.auth != null && request.auth.uid == uid;
}
// Items belong to the user who created them
match /items/{itemId} {
allow read: if request.auth != null && resource.data.ownerId == request.auth.uid;
allow create: if request.auth != null && request.resource.data.ownerId == request.auth.uid;
allow update, delete: if request.auth != null && resource.data.ownerId == request.auth.uid;
}
// Everything else is denied by default
}
}5. Hosting, push and domains
| Topic | What to do | WebViewGold side |
|---|---|---|
| Hosting custom domain | Firebase Hosting → Add custom domain, set the DNS records, wait for the certificate. Use this domain as authDomain and as the Site URL in email templates. | Start URL in Config.swift / Config.java or the Cloud Builder |
| Push: FCM directly | Register the iOS bundle ID and Android package name in the Firebase project, download GoogleService-Info.plist and google-services.json, upload an APNs key under Cloud Messaging. | kFirebasePushEnabled (iOS) and FIREBASE_PUSH_ENABLED (Android); optional firebaseTopic; the device token is available as firebaseplayerid after getfirebaseplayerid://. Docs: iOS push, Android push |
| Push: OneSignal instead | For segments and a campaign dashboard without Cloud Functions; it sits next to Firebase without conflict. | oneSignalID + kPushEnabled / PUSH_ENABLED; comparison in the push provider guide |
| Deep links | Firebase Dynamic Links has been discontinued. Use Universal Links and App Links on your own domain for email links and sharing. | Associated Domains + ShowExternalLink (iOS), IS_DEEP_LINKING_ENABLED (Android) |
6. Data safety and App Privacy for Firebase signals
Google compares SDK signals in the binary with your answers; Apple expects you to declare everything the app does, web content included.
- Firebase Auth: email address and user ID, linked to the user. Declare under "Personal info" (Play) and "Contact info" plus "Identifiers" (Apple).
- Firestore and Storage user content: "App activity" / "User content". If users upload photos, say so.
- FCM push: the device token counts as a device identifier for app functionality. If you use OneSignal instead, the same applies.
- Google Analytics, if your web app loads it: usage data for analytics; not tracking in Apple's sense unless linked with ad networks. Crashlytics on Android (
TRACKING_EVENT): crash logs and diagnostics. - Do not answer "no data collected" to get through faster; a mismatch with the SDK signals is a common Play rejection (see the Data safety mismatch guide).
Frequently asked questions
Do I have to add the Firebase native SDKs to the WebViewGold project?
No. Your web app keeps using the JavaScript SDK. Native Firebase components are only involved for push or Crashlytics, and WebViewGold includes them behind a config switch.
Why does Google sign-in work in Chrome but not in my app?
Google blocks OAuth inside embedded WebViews. The WebViewGold Social Login Helper opens the Google step in a window Google accepts and returns the result to your app.
Does Firestore offline persistence work in the app?
Yes, IndexedDB is available in WKWebView and the Android WebView. Still enable the WebViewGold offline screen for the first load, when no cache exists yet.
How do I send a push to one specific user?
Store the token from getfirebaseplayerid:// (or the OneSignal subscription ID) in the user's Firestore document and send from a Cloud Function with the Admin SDK or the OneSignal REST API.
Three ways to get your app into the stores
Same result, different amount of work on your side. All three come with the approval guarantee and 24/7 human support.
Cloud Builder
$349 per license, one-time add-on
No Mac, no Xcode, no Android Studio: configure in the browser, we build both apps in the cloud and hand them to App Store Connect and the Play Console.
How the Cloud Builder works Try the free demoFull Service
$698 per platform $798
Send us your URL and icon. Our team configures, builds and delivers your app within 72 hours, white-label, with source projects. Both platforms for $1,158.
Full Service details Powered by
Winter Sale prices valid until December 31, 2026.