Backends: Supabase, Firebase & secrets

Most real apps need a backend, a database, sign-in, file storage. FlutterGo works with Supabase and Firebase, and the AI agent knows how to wire them into your Flutter code.

There are three pieces. Connectors (in Settings) link your Supabase or Firebase account so the agent can inspect your real projects. Setup panels collect the config files and keys each service needs. And the Secrets vault stores everything sensitive, encrypted, per project, and never pushed to GitHub.

You don't have to learn the services first. Connect, then ask the agent in plain language: "add sign-in with Supabase" or "set up Firebase for this app".

What you need#

• A Supabase account (free tier is fine) and/or a Firebase project created in the Firebase console.
• The Secrets vault is included on the Business plan and above. Without it, integration configs save directly into your Flutter project instead of encrypted vault storage, the setup panels tell you which applies.
• Nothing to install; everything happens in Settings and the chat.

[[tabs]]

[[tab:Firebase]]

Watch the complete setup, recorded end to end — nothing is staged: the agent prompt, the Firebase console, the config upload, a real sign-up in the running app, and the user appearing in Firebase Authentication.

The full journey in ~2½ minutes, from "set up Firebase for this app" to a real user row in Firebase console → Authentication → Users.

Firebase, step by step#

Step 1 — Tell the agent to set up Firebase#

Open your project and send a plain-language prompt, for example: "Set up Firebase for this app: add Firebase Core and email/password authentication with login and sign-up screens, and gate the app behind sign-in." The agent adds firebase_core and firebase_auth, creates the login and sign-up screens, an auth provider, and wires the router.

One sentence is enough — the agent knows the FlutterFire wiring.

Step 2 — Create a project in the Firebase console#

Go to console.firebase.google.com, click Create a new Firebase project, give it a name, and click through — you can switch Gemini and Google Analytics off for a lean demo project. After ~30 seconds you land on the project overview.

Name it, skip the extras, create — Firebase provisions the project in under a minute.

Step 3 — Register your Web, Android, and iOS apps#

In Project settings → Your apps, click Add app and register each platform:

One Firebase project holds all three apps: Web (\</\>), Android, and Apple.

• Web — nickname it and copy the SDK setup JSON (the firebaseConfig block).
• Android — enter the package name from android/app/build.gradle.kts (applicationId), then Download google-services.json.
• iOS (Apple) — enter the bundle ID from your Xcode project, then Download GoogleService-Info.plist.

Each platform wizard ends with its config file download — you'll attach all three in FlutterGo.

Step 4 — Enable Email/Password authentication#

Open Authentication → Get started → Sign-in method, choose Email/Password, flip Enable, and Save. Without this step every sign-in attempt fails with operation-not-allowed.

The provider list confirms: Email/Password — Enabled.

Step 5 — Attach the config files in FlutterGo#

Back in your project, the Setup Progress checklist now shows Firebase setup — "Tap to provide." Tap it: the panel asks for exactly the three files from Step 3. Attach google-services.json, GoogleService-Info.plist, and the web config JSON, then click Continue. The files are stored (encrypted vault on Business+) and materialized into your project.

Each field says exactly where in the Firebase console its file comes from.

Step 6 — Rebuild and create a real account#

Click Rebuild. The app now boots to the agent-built login screen — click Sign Up, enter an email and password, and press Create Account. This is a live call to Firebase.

The login screen the agent generated — email, password, and a Sign Up link.

A real account about to be created against your Firebase project.

Sign-up succeeds and the app opens — the router now gates everything behind auth.

Step 7 — See the user in Firebase#

In the Firebase console, open Authentication → Users and hit refresh: your new user is there, with provider, creation date, and UID.

Proof of the full loop: the account created inside your app, recorded by Firebase.

Success: Your app now has working Firebase authentication on Web, Android, and iOS — from one prompt, one console session, and three attached files.

[[tab:Supabase]]

Supabase, step by step#

Step 1, Open Connectors in Settings#

Open Settings and choose Connectors in the left navigation ("External system connections"). You'll see a searchable list of services with categories and a status for each: Available, Connected, or Disabled.

Step 2, Connect Supabase or Firebase#

Find Supabase ("Inspect Supabase projects, tables, and storage buckets…") or Firebase ("Inspect Firebase projects and resources…") and click Connect. An authorization window opens; the panel shows "Waiting for authorization…", complete authorization in the opened window. When done, the status changes to Connected. Use Disconnect any time to revoke it.

Step 3, Ask the agent to wire the backend#

Go back to your project conversation and describe what you want:

• "add sign-in with Supabase", the agent wires up database, auth, and storage.
• "set up Firebase for this app", FlutterFire is configured via the built-in bootstrap.

The agent uses its backend skills to add packages, initialization code, and screens.

Step 4, Fill in the setup panel when asked#

When a service needs configuration, a setup panel opens in the workspace (it also appears as an item in the project's setup checklist).

Firebase setup, "Download your Firebase config files from the Firebase console and attach them below." Attach:

1. Android, google-services.json (Firebase console, then Project settings, then Your apps, then Android app)
2. iOS, GoogleService-Info.plist (…, then iOS app)
3. Web, Firebase config JSON (…, then Web app, then SDK setup JSON)

Supabase setup, add:

1. Project URL (Supabase Dashboard, then Project Settings, then API, then Project URL)
2. Anon public key (same page, then anon public key)

Use Attach file for each item, then click Continue. Files already saved show "Already in Secrets vault."

Important: Use the Supabase anon key in your Android and iOS app together with Row Level Security, never put the service role key in app code. The same rule applies to any server-side secret.

[[/tabs]]

Manage the Secrets vault#

Open Settings, then GitHub & Secrets. The Secrets vault section manages secrets per project, pick the project at the top.

1. Use Quick add by platform to pick a common secret (e.g. Firebase config, android/app/google-services.json, Upload keystore, App Store Connect API key, Stripe secret key, .env, DATABASE_URL).
2. Or add manually: choose File or Env var, enter the target path or variable name, paste or upload the value, and click Add secret.
3. Every stored secret is listed with its kind, target, size, date, and who added it, You or Agent (agent-created signing keys and configs show up here automatically).
4. Materialize into working tree now writes the files and env vars into the project's working directory on demand, this also happens automatically when the project opens.

Success: After Continue in a setup panel, your configs are stored (encrypted vault on Business+), materialized into the project, and the agent carries on with the wiring.

What goes where?#

Tip: Besides Supabase and Firebase, setup panels exist for Stripe (publishable + secret key) and a generic Database (DATABASE_URL connection string). The Stripe panel reminds you: the publishable key can be used in Flutter; the secret key stays in the vault and must never ship in client code.

Troubleshooting#

Problem: The connector authorization window never completes. Possible causes: The window was closed early; a popup blocker; connectors not enabled on the server. Solution:

1. Click Cancel on "Waiting for authorization…" and click Connect again.
2. Allow popups for FlutterGo.
3. Self-hosted: an administrator must configure the Composio key and enable connectors in the admin Connectors panel.

Problem: The setup panel says Secrets Vault is required. Possible causes: Your plan doesn't include the vault. Solution:

1. The message reads: "Secrets Vault is required to store integration configs. Upgrade to \<plan\> or above in Settings, then Billing."
2. Alternatively, on lower plans configs save directly into your Flutter project, the panel says so when that mode applies.

Problem: The app builds but Firebase/Supabase calls fail at runtime. Possible causes: Config files not materialized; wrong key; missing platform config. Solution:

1. In Settings, then GitHub & Secrets, then Secrets vault, check the expected files are listed, then click Materialize into working tree now.
2. Re-check the values against the service dashboard (URL, anon key, config files per platform).
3. Paste the runtime error into the chat, the agent repairs configuration issues too.

Problem: I accidentally added a secret with the wrong value. Possible causes: Typo or wrong file attached. Solution:

1. Click Remove next to the secret in the vault list.
2. Add it again (same target path), then Materialize into working tree now.

FAQ#

Do my keys end up on GitHub? No. Vault secrets are encrypted at rest, excluded from Git pushes, and only materialized into the local working directory. Deploy credentials use encrypted CI secrets.

Which backend should I pick? Both work well with Flutter. Supabase gives you a Postgres database, auth, and storage with a generous free tier; Firebase is Google's suite with the FlutterFire SDKs. If unsure, ask the agent to recommend one for your app's needs.

Can the agent add secrets by itself? Yes. Agent-created signing keys and config files appear in the vault automatically, tagged Agent so you can tell them apart from your own entries.

What's the difference between a connector and the setup panel? The connector (Settings, then Connectors) links your account so the agent can inspect your real backend projects. The setup panel collects the concrete config files/keys your Android and iOS app needs at build and run time.

Is the Secrets vault free? It's included on the Business plan and above. Below that, integration configs save directly into your Flutter project instead of encrypted vault storage.

Can I store any file, not just backend configs? Yes, the vault accepts any file (up to a few MB) or env var: certificates, .pem keys, .env files, custom API keys.

Where to go next#

• Working with the AI agent
• Publishing to Google Play
• Save your code to GitHub