{"id":6714,"date":"2025-10-21T07:35:50","date_gmt":"2025-10-21T07:35:50","guid":{"rendered":"https:\/\/obsidiansofteducation.com\/?page_id=6714"},"modified":"2025-11-15T17:55:53","modified_gmt":"2025-11-15T17:55:53","slug":"mit-app-inventor-firebase-authentication-realtime-database-tutorial","status":"publish","type":"page","link":"https:\/\/obsidiansofteducation.com\/index.php\/mit-app-inventor-firebase-authentication-realtime-database-tutorial\/","title":{"rendered":"MIT App Inventor Firebase Authentication and Secure Database – Save\/Load User Specific Data"},"content":{"rendered":"\n

Hello friends, and welcome to Obsidian Soft,<\/p>\n\n\n\n

Today, I will show you the real power of Firebase using their authentication with their Realtime Database. We will develop a small example of Firebase authentication using email and password, where users can add or view their own notes, but after securely logging in to the app. Firebase authentication also has Google sign up and sign in, but that process is a little complicated and lengthy, so I will cover Google sign up in a later tutorial.<\/p>\n\n\n\n

This is the demo of the app at work. I can sign up using any email account. It is so much easier to remember your emails as compared to user names, and everyone has at least one email address. So, you enter an email and provide a password. I will log in as I have already signed up with this account. And you are taken to your notes screen where only your notes are loaded. Let\u2019s go back and try signing up. I will use a different email address and password. And now a new user will be created in the system against this email and this time the notes screen doesn\u2019t have anything as I am a different user now. <\/p>\n\n\n\n

So, let\u2019s begin:<\/p>\n\n\n\n

First, we need to create our project in Firebase, in which we will have authentication and a realtime database.<\/p>\n\n\n\n

Open up the Firebase console: https:\/\/console.firebase.google.com\/<\/a><\/p>\n\n\n\n

Create a new project, e.g., NotesProject, and go with the default settings. <\/p>\n\n\n\n

Click on Authentication on the left side. If you don\u2019t see it, then click on the build tab on the left side. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Click on Get started button. Choose email\/password. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

It will take you to another page. Enable only Email\/Password sign-in here.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 Now, we also need a database in this project, so click on Realtime Database on the left again under the build tab.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Then, click on ‘Create Database’ button and choose the location nearest to you. For example, I chose Singapore. And then start the database in locked mode. Now, you can see the difference. For the Firebase DB component in our earlier tutorials<\/a>, we started in test mode, and we kept the project in that mode, which was unsafe, as anyone could see our data if they had the link. Locked mode means no one<\/em> can read\/write to our database. After the database is created, you will see the reference URL to your database.<\/p>\n\n\n\n

Copy it by clicking on that chain icon and paste it into Notepad or some other text editor. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now, click on the rules tab. Right now, read and write are both locked. Remove the rules and paste this <\/strong>in its place:<\/p>\n\n\n\n

{\n  \"rules\": {\n    \"users\": {\n      \"$uid\": {\n        \".read\": \"auth != null && auth.uid === $uid\",\n        \".write\": \"auth != null && auth.uid === $uid\"\n      }\n    }\n  }\n}\n<\/code><\/pre>\n\n\n\n
and don’t forget to click on the Publish <\/strong>button. <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\ud83d\udd0d What do these rules mean?<\/strong><\/h4>\n\n\n\n
These are Firebase Realtime Database Security Rules<\/strong>.<\/p>\n\n\n\n
Only a logged-in user (auth != null) <\/strong>can access data, and a user can see his or her own data and not anyone else\u2019s (auth.uid === $uid)<\/strong>.<\/p>\n\n\n\n
We also need the API key for our project. The process was easier before but recently they have changed it but no worries as I have got you covered.<\/p>\n\n\n\n
Click on Project Overview on the left.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now, click on Add App.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Choose Web app (the round button with <\/> <\/strong>on it)<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Give some name to your web app and click on Register app button.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
After a few seconds, some details will show up. Copy the apiKey. This is your Web API key.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Paste it where you also pasted the URL for the Firebase Realtime Database. Keep your Web API key secure.\u00a0Don’t use my API key as it will not work; I have already deleted this project.<\/em><\/p>\n\n\n\n
Let\u2019s head to MIT App Inventor to make our very awesome notes in the cloud app. Unfortunately, with this project, we cannot use the built-in Firebase DB component, and we will need to post our requests to the Firebase Realtime Database using the web component but don\u2019t worry, I will go slow and explain each step and we have used the web component many times before too when connecting with different APIs.<\/p>\n\n\n\n
A simple screen here with align horizontal and align vertical properties both centered. A text box from the UserInterface palette for email. Rename to emailTxt. Make font bold, font size 18, and change hint to Enter email. Add a password textbox below. Make font bold, font size 18, and change hint to Enter password.<\/p>\n\n\n\n
A button for sign up. Rename to signupBtn. Duplicate by selecting it and pressing Ctrl + C and Ctrl + V<\/strong> on the keyboard for Windows or Command + C and Command + V<\/strong> for macOS. Rename to loginBtn and change text to \u201cLog In\u201d. Add a notifier from the User Interface palette for error messages and a web component from the Connectivity palette for talking to the Firebase.<\/p>\n\n\n\n
Add another screen. Let\u2019s call it mainScreen. In screen properties, make it align horizontal and align vertical both center.<\/p>\n\n\n\n
Add a textbox for entering notes. Add a button for saving. Customize them just like the previous screen.<\/p>\n\n\n\n
Add a list view for showing previous notes for the user. Also, add a notifier for showing messages. We need another web component for this screen.<\/p>\n\n\n\n
Also, add a clock from sensors for storing time with our notes.<\/p>\n\n\n\n
Choose screen1 again and go to the blocks section.<\/p>\n\n\n\n
Two global variables for containing the user\u2019s unique identifier and token. These are sent by Firebase Authentication after a successful sign-up or login, and we need to store them to access the Realtime Database securely. Also, make a global variable for your  API key and paste your Web API key in there that you had copied into your notepad. Don\u2019t share your api key with anyone.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Our sign-up and log-in procedures are almost identical except for the web URL, so it is best to make a procedure. Hence, go to the Procedures section on the left and get the first type of block. Rename to signUpLoginPost. Click on the cog wheel to add an input parameter called url.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Here, we need to do error handling, so from Control, get an IF\/ELSE block. In IF, add a condition for checking that the email textbox OR <\/strong>the password textbox isn\u2019t empty. In the IF body, i.e., the place we will go when the IF condition is true, use the notifier to show an alert that both email and password are needed.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
What will happen in ELSE?<\/p>\n\n\n\n
We provide the input URL to the web\u2019s URL property. We set the Web\u2019s request headers to a dictionary with key: \u201cContent-Type\u201d and value: \u201capplication\/json\u201d. And then we send the user-entered data as a dictionary to the Firebase authentication system with returnSecureToken<\/strong> set to true. Please do it the same way, as the spellings of the keys are super important.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now, what are the actual URLs:<\/p>\n\n\n\n
They are different for both sign-up and login button click events.<\/p>\n\n\n\n
For the signup button, the URL text box should be equal to a join of two things:<\/p>\n\n\n\n
    \n
  1. https:\/\/identitytoolkit.googleapis.com\/v1\/accounts:signUp?key=<\/a><\/li>\n\n\n\n
  2. Your API key that you stored in the global variable.<\/li>\n<\/ol>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    For the login button,  the URL text box should be equal to a join of two things:<\/p>\n\n\n\n
      \n
    1. https:\/\/identitytoolkit.googleapis.com\/v1\/accounts:signInWithPassword?key=<\/a><\/li>\n\n\n\n
    2. Your api key that you stored in the global variable.<\/li>\n<\/ol>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      I will give them in the video description, so copyand  paste them carefully.<\/p>\n\n\n\n
       Both sign-up and login buttons follow the same process of posting to the Web, so both will trigger the Web\u2019s gotText event, so get that.<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Again, because of error handling, we need an IF\/ELSE block from Control. In IF, we first check that the response code is equal to 200. This is the standard web response for a successful request. If successful, we are going to decode our response content into a dictionary called responseDict. <\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Now, we have a dictionary in the form of something like this returned by Firebase authentication:<\/p>\n\n\n\n
      {\n\n  \"idToken\": \"eyJhbGciOiJSUzI1NiIsImtpZCI6IjA...\",\n\n  \"email\": \"user@example.com\",\n\n  \"refreshToken\": \"AEu4IL3i6K9oZg0zjB0D6VfL9g...\",\n\n  \"expiresIn\": \"3600\",\n\n  \"localId\": \"ZxY123abc456def789ghi012jkl\",\n\n  \"kind\": \"identitytoolkit#SignupNewUserResponse\"\n\n}<\/code><\/pre>\n\n\n\n
      We are interested in two things. The localId and the idToken (spellings and case are both important here). We are going to use Dictionary\u2019s getValue for the Key block to get these values by specifying exact keys and store them in our global variables uid and token, respectively. And we will open the second screen, passing these values in a dictionary.<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Our else is for error handling, considering different situations.<\/p>\n\n\n\n
      So the final Web.GotText looks like this:<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Our screen 1 is done and we have sent the data to the second screen. <\/p>\n\n\n\n
      So let\u2019s work on the blocks on our second screen.<\/p>\n\n\n\n
      First, we make a global variable for our notesList.<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Then, we make global variables for uid and token and set them to the data sent as a dictionary from the first screen.<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Now, in the second screen\u2019s initialize event, we need to load and show the already saved notes, if any.<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      The URL here is made up of a join of 5 things<\/strong>, and each piece is super important. <\/p>\n\n\n\n
        \n
      1. The URL of your real-time database that you had copied and pasted in Notepad earlier.<\/li>\n\n\n\n
      2. users\/<\/li>\n\n\n\n
      3. Global variable uid<\/li>\n\n\n\n
      4. \/notes.json?auth=<\/li>\n\n\n\n
      5. Global variable token<\/li>\n<\/ol>\n\n\n\n
        Make sure that there are no typing mistakes in parts 1,2, and 3.<\/p>\n\n\n\n
        The web1.get will trigger the gotText event, but before working on that, let\u2019s work on our saveBtn code. We check that the note’s text isn\u2019t empty, and then we set exactly the same URL as we used in the screen\u2019s initialize event, so duplicate from there.<\/p>\n\n\n\n
        Then we make a dictionary of two things: clock.now and notesTxt.text against their respective keys of \u201ctime\u201d and \u201cnote\u201d. And we post this as text to the Web. In the else, we show an alert that enter a value for the note.<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        The postText also triggers the Web\u2019s gotText event, so now, let\u2019s finally work on our final event, i.e., the Web\u2019s gotText event. First, we check that we got a successful response from the server. If not, we show the error using the notifier\u2019s show alert block.<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Now, remember that a successful response could be because of two things. Either we loaded data successfully or we saved a new note successfully. How to differentiate?<\/p>\n\n\n\n
        If responseContent isn\u2019t null and it doesn\u2019t contain the word \u201cname<\/strong>\u201d, then this means that this was a successful load. In the other case, this was a successful save, so we reload the data by calling Web1. Get. No need to set web1.url again as it was set already earlier.<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Read the italicized sentences if you want to know more about using \u201cname\u201d.<\/strong><\/p>\n\n\n\n
        Why the word “name” for differentiating between save and load?<\/em><\/strong><\/p>\n\n\n\n
        In case of a successful save, the Firebase Database generates a unique ID for your data, and it sends it back as JSON in the form of a key-value pair, where the key is \u201cname\u201d, so we can assume that if our response content contains \u201cname\u201d, it means a successful save.<\/em><\/p>\n\n\n\n
        {<\/em><\/p>\n\n\n\n
          “name”: “-NxR3C78YZkX5a9Qxyz”<\/em><\/p>\n\n\n\n
        }<\/em><\/p>\n\n\n\n
        And if it doesn\u2019t, then it is a successful load.<\/em><\/p>\n\n\n\n
        Once we know it was a successful load, we set our notesList to an empty list. We decode the response content in a local responseDict variable.<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Following is a snapshot of my current state of Realtime Database:<\/p>\n\n\n\n
        <\/p>\n\n\n\n
        We had sent a dictionary of note and time, and it was saved against a unique key generated by Firebase. <\/p>\n\n\n\n
        We can get all these \u201cnote dictionaries\u201d by using a for each key with value block from Control to go through our responseDictionary. Here each value is a \u201cnote dictionary\u201d with two key value pairs. We get these values and join them with a \u201c – \u201c in between to make a display string or text and we add it to our notes list.<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        Once the for loop is finished, we need to give our notes list as elements to our listview.<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        So, our final gotText looks like this:<\/p>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        And this is done. I hope you liked this tutorial. You can check out my video tutorial for this project split into two videos:<\/p>\n\n\n\n
        Part 1:<\/strong><\/p>\n\n\n\n
        \n