Step-by-Step Guide to Firebase MFA in React Native CLI

Implementing MFA Enrollment

When a new user registers, the app must enroll a second factor (phone number).

First, obtain the multi-factor user session:

import {

PhoneAuthProvider,

PhoneMultiFactorGenerator,

getAuth,

multiFactor

} from ‘@react-native-firebase/auth’;

const multiFactorUser = await multiFactor(getAuth().currentUser);

const session = await multiFactorUser.getSession();

Next, send a verification code to the user’s phone number.

const verificationId = await new PhoneAuthProvider(getAuth())

.verifyPhoneNumber({ phoneNumber, session });

Finally, verify the OTP and enroll the second factor.

const credential = PhoneAuthProvider.credential(

verificationId,

verificationCode

);

const multiFactorAssertion =

PhoneMultiFactorGenerator.assertion(credential);

await multiFactorUser.enroll(multiFactorAssertion);

This links the user’s phone number as the second authentication factor.

Handling MFA During Login

When an existing user with MFA enabled tries to log in, Firebase throws a special error indicating that additional verification is required.

Example login attempt:

signInWithEmailAndPassword(auth, email, password)

If MFA is required, Firebase returns:

auth/multi-factor-auth-required

Using the resolver provided by Firebase, we can send the OTP to the registered phone number and verify it.

const resolver = getMultiFactorResolver(auth, error);

const verificationId =

await auth.verifyPhoneNumberWithMultiFactorInfo(

resolver.hints[0],

resolver.session

);

Once the user enters the OTP, the authentication process is completed.

Key Security Benefits

Implementing MFA in mobile applications provides several advantages:

Stronger Account Protection

Even if passwords are compromised, attackers cannot access the account without the second factor.

Reduced Risk of Credential Theft

Many cyberattacks rely on stolen credentials. MFA adds another layer of verification.

Industry-Standard Security

MFA is widely used in:

• Banking and fintech applications
• Healthcare systems
• Enterprise platforms
• Applications storing sensitive data

Developer Benefits

Using Firebase MFA also improves the development workflow:

• Built-in authentication infrastructure
• SMS OTP delivery handled by Firebase
• Secure verification mechanisms
• Minimal backend configuration

Developers can focus on application features instead of building authentication systems from scratch.