8.1.0

Added support for firebase/php-jwt:^7.0.2

---

Important

Support the project: This SDK is downloaded 1M+ times monthly and powers thousands of applications.
If it saves you or your team time, please consider sponsoring its development.

8.0.0

Security improvements

• Added #[SensitiveParameter] attributes to methods handling sensitive data (passwords, tokens, private keys)
  to prevent them from appearing in stack traces and error logs.

Breaking changes

• The SDK supports only actively supported PHP versions. As a result, support for PHP < 8.3 has been dropped;
  supported versions are 8.3, 8.4, and 8.5.
• Firebase Dynamic Links was shut down on August 25th, 2025
  and has been removed from the SDK.
• Deprecated classes, methods and class constants have been removed.
• Method arguments are now fully type-hinted
• Type declarations have been simplified to reduce runtime overhead (e.g., Stringable|string to string).
• The transitional Kreait\Firebase\Contract\Transitional\FederatedUserFetcher::getUserByProviderUid() method
  has been moved into the Kreait\Firebase\Contract\Auth interface
• Realtime Database objects considered value objects have been made final and readonly
• psr/log has been moved from runtime dependencies to development dependencies
• Kreait\Firebase\Contract\Messaging::BATCH_MESSAGE_LIMIT constant has been removed
• Exception codes are no longer preserved when wrapping exceptions
• Kreait\Firebase\Messaging\CloudMessage builder methods have been renamed to follow the with* pattern:
  toToken() -> withToken(), toTopic() -> withTopic(), toCondition() -> withCondition().
  The old methods are deprecated but still available as aliases.

See UPGRADE-8.0 for more details on the changes between 7.x and 8.0.

7.x Changelog

https://github.com/kreait/firebase-php/blob/7.24.0/CHANGELOG.md

---

Important

Support the project: This SDK is downloaded 1M+ times monthly and powers thousands of applications.
If it saves you or your team time, please consider sponsoring its development.

7.24.0

Changed

• Realtime Database references are now validated by the API instead of locally. Validation rules can change at any time, and the SDK can only adapt to changes in the API. While local checks could prevent obviously invalid paths, they'd also require an SDK update whenever Firebase loosens a rule. Developers can be trusted not to use invalid paths 😅.
• Removed the #[SensitiveParameter] attribute again, because it's supported by PHP 8.1 itself, but not in combination with Valinor. (#1034)

---

Important

Support the project: This SDK is downloaded 1M+ times monthly and powers thousands of applications.
If it saves you or your team time, please consider sponsoring its development.

7.23.0

Require cuyz/valinor:^2.2.1 for better mapping.

7.22.0

Added

• Added support for PHP 8.5

Changed

• The project now features a custom logo (I came up with it myself, and took the wise decision to not look up if there's something similar already)
• Refined README for improved clarity, removed outdated documentation sections, and streamlined project support messaging with a more positive call to action
• Documentation now uses the modern Furo theme, providing a cleaner and more pleasant reading experience

---

Important

Support the project: This SDK is downloaded 1M+ times monthly and powers thousands of applications.
If it saves you or your team time, please consider sponsoring its development.

7.21.2

Fixed

• Re-added the #[SensitiveParameter] attribute because, while it's not supported in PHP 8.1, it can still be used if placed in a standalone line above the variable or property.
• Re-added support for JSON files with any file extension
• With the introduction of Valinor, Service Account credentials were required to have more fields than necessary to work with the SDK, although it only needs the client email, private key, and project ID.

7.21.1

Fixes

Removed the #[SensitiveParameter] attribute because it's not supported in PHP 8.1.

7.21.0

Changed

This release introduces Valinor for type-safe object mapping. The first application is mapping a given service account file, JSON, or array to the newly added internal ServiceAccount class, with more to follow in future releases.

7.20.0

• You can now get a user by their federated identity provider (e.g. Google, Facebook, etc.) UID with Kreait\Firebase\Auth::getUserByProviderUid(). (#1000).

  Since this method couldn't be added to the Kreait\Firebase\Contract\Auth interface without causing a breaking change, a new transitional interface/contract named Kreait\Firebase\Contract\Transitional\FederatedUserFetcher was added. This interface will be removed in the next major version of the SDK.

  There are several ways to check if you can use the getUserByProviderUid() method:

use Kreait\Firebase\Contract\Transitional\FederatedUserFetcher;
use Kreait\Firebase\Factory;

$auth = (new Factory())->createAuth();
// The return type is Kreait\Firebase\Contract\Auth, which doesn't have the method

if (method_exists($auth, 'getUserByProviderUid')) {
    $user = $auth->getUserByProviderUid('google.com', 'google-uid');
}

if ($auth instanceof \Kreait\Firebase\Auth) { // This is the implementation, not the interface
    $user = $auth->getUserByProviderUid('google.com', 'google-uid');
}

if ($auth instanceof FederatedUserFetcher) {
    $user = $auth->getUserByProviderUid('google.com', 'google-uid');
}

• The new method Kreait\Firebase\Factory::withDefaultCache() allows you to set a default cache implementation for the SDK. This is useful if you want to use one cache implementation for all components that support caching. (Documentation)

Deprecated

• Kreait\Firebase\Factory::getDebugInfo

What's Changed

• Enable getting a user by their federated IdP UID by @jeromegamez in #1003
• Add and address PHPStan strict rules by @jeromegamez in #1006
• Add previous exceptions to api exceptions by @BackEndTea in #1008

New Contributors

• @BackEndTea made their first contribution in #1008

Full Changelog: 7.19.0...7.20.0

7.19.0

Added

• You can now save on method call by passing a custom Firestore database name to Kreait\Firebase\Factory::createFirestore($databaseName) instead of having to chain ::withFirestoreDatabase($databaseName)->createFirestore()
• It is now possible to set live activity tokens in Apns configs.
• Kreait\Firebase\Http\HttpClientOptions::withGuzzleMiddleware() and Kreait\Firebase\Http\HttpClientOptions::withGuzzleMiddlewares() now accept callable strings, in addition to callables. (#1004)

Deprecated

• Kreait\Firebase\Factory::withFirestoreDatabase()