feat(auth): TOTP and unenroll MFA

[jamespb97]

Description

The aim of these changes is to enable TOTP MFA and the ability to un-enroll from either SMS or TOTP MFA.

The motivation behind doing this was to migrate away from Firebase JS SDK implementation on our existing Expo application which extensively uses multi-factor authentication.

This is my first time ever changing native code like this. My workflow at the moment for making these changes have simply been editing the native modules in the respective code editors (Xcode and Android Studio), then using patch-package and building new development builds each time and testing live against our development environment, so nothing has been emulated.

I tried to link my forked repo locally using npm/yarn link and build off that instead but I couldn't get it to work so I had to go the patch-package route and copy across all of my changes to my fork manually. If you're aware of a better way to do this please let me know!

I am aware that there is a blocking issue (firebase/firebase-tools#6224) which prevents TOTP being tested within emulation, so I guess proper tests cannot be written just yet for this feature (unsure about unenroll feature).

Related issues

#7483
Abandoned related PR: #7718

Release Summary

Add support for enrolling TOTP multi-factor authentication, authentication using TOTP and un-enrolling multi-factor authentication.

Checklist

• I read the Contributor Guide and followed the process outlined there for submitting PRs.
  • Yes
• My change supports the following platforms;
  • Android
  • iOS
  • Other (macOS, web) (NOTE: When using shims replacing imports with firebase js sdk, this should work as the APIs are exactly the same as the web sdk - [🐛] Other Platforms - [Web] [Auth] Methods are unsupported or not existing #7921 (comment))
• My change includes tests;
  • e2e tests added or updated in packages/\*\*/e2e
  • jest tests added or updated in packages/\*\*/__tests__
• I have updated TypeScript types that are affected by my change.
• This is a breaking change;
  • Yes
  • No

Test Plan

I currently only have this working in our product application which won't be possible to post videos or screenshots of on a public PR, but I can create a minimum repro app soon enough (probably in my free time over the weekend) and post videos and screenshots from that instead.

Update:
As promised, here is a demo of the changes in action along with a demo repo: https://github.com/jamespb97/firebase-totp-demo
To run just change the app.json accordingly and copy across your firebase service files and it should all work.

Android:

Android.Demo.mp4

iOS:

iOS.demo.mp4

---

Think react-native-firebase is great? Please consider supporting the project with any of the below:

• 👉 Star this repo on GitHub ⭐️
• 👉 Follow React Native Firebase and Invertase on Twitter

🔥 🔥 🔥

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
react-native-firebase	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Aug 4, 2025 5:13pm

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ jamespb97
❌ James Bateman

---

James Bateman seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[mikehardy]

I'm not aware of a better way to do this given we don't have TOTP support in the emulator, your patch-package based development workflow sounds both a) really painful and objectively awful and also b) like the best way

Sorry for the a) painful + awful part, I wish there was a better way

That said, this is incredible if you've got this working with an app that uses MFA and TOTP so you know it's working on both platforms - for the avoidance of doubt, you confirm that is the case? it is tested and working in your app on android and iOS ? If so, this is exciting

[jamespb97]

@mikehardy I appreciate the feedback re my workflow 😆

For the proof, yes, I was meant to whip up a little demo app which I just didn't get time to do over the weekend. I'll see what I can do, hopefully, this week.

I am just about to deploy our app to our production environment with this patch as it has all been going very well in testing. Any fixes or changes that might crop up I am making sure to push back into this PR.

[Daniel528]

Hey @mikehardy I've seen there's the firebase emulator blocking issue which doesn't seem to have any movement from the emulator team.

Is a TOTP implementation for this library at all possible to merge into main without e2e testing? If the maintainers are comfortable having it implemented without the full automated test suite and with a heavy caveat for anyone who chooses to use it, I'm happy to lend some time to get this PR polished and merged to main.

If it's not a go without those tests though then all good.

[mikehardy]

I've got a different way to verify it I think and will be trying an experiment to verifiy if it will work or not shortly. The PR to implement it can go in either way though. Can't really have a regression on something that didn't work before, no reason to reject a community PR based on that...

[jamespb97]

@mikehardy I have updated the description with demos as promised. Let me know what you think

[Daniel528]

@jamespb97 A PR I've authored recently will conflict with this PR. I'm happy to manage the conflicts if you bring this fork up to date with main. Can make a branch and get you to review it before merging back the PR branch.

[igperez-ar]

Great contribution @jamespb97!
This feature is something very important for a project I'm working on, there's any updates? Estimated time when this will be available in a new version of the library? Thanks in advance

[jamespb97]

@jamespb97 A PR I've authored recently will conflict with this PR. I'm happy to manage the conflicts if you bring this fork up to date with main. Can make a branch and get you to review it before merging back the PR branch.

No problem, I’m away the next few days but when I get a moment I’ll sort it out 👍