Sign-in
How customers sign in to the Storefront App — phone number and texted code, Sign in with Apple and Sign in with Google — with the Apple and Google OAuth setup step by step.
Sign-in
Customers can browse and fill a cart without an account; they sign in to check out. Phone number and texted code is always available. Sign in with Apple and Sign in with Google can be added.
Phone number and code
The customer enters their number (the country picker starts on DEFAULT_COUNTRY, or the phone's region), receives a code by text and enters it. A new customer is asked their name; an existing one is signed straight in. The texts are sent through the SMS provider set up on your Fleetbase instance, and sending is rate limited per device and number. See Customer Authentication.
From their account customers edit their photo, name, email and phone. A new phone number is confirmed with a code sent to that number.
App Store and Google Play review
Reviewers can't receive your texts, so they need a fixed code for a review account. On the Fleetbase server, set both:
STOREFRONT_BYPASS_VERIFICATION_CODE=<a secret code, rotated after review>
STOREFRONT_REVIEW_ACCOUNTS=+15555550100,apple-review@example.comThe code only works for the identities listed. Give the number and code to the reviewer in App Store Connect's review notes or the Play Console's app access section. Without both settings there is no bypass at all.
Sign in with Apple
Shown on iOS. Apple's App Review guidelines ask iOS apps that offer a third-party sign-in such as Google to also offer Sign in with Apple or an equivalent privacy-focused option.
In your Apple Developer account, enable Sign in with Apple for the app's identifier.
In Xcode, check Sign in with Apple is under Signing & Capabilities (the app's entitlements already include it).
Set APPLE_LOGIN_ENABLED=true in .env and rebuild.
Sign in with Google
Shown on iOS and Android. It needs three OAuth clients in one Google Cloud project, and two of their ids in .env.
Consent screen. In Google Cloud Console → APIs & Services → OAuth consent screen, set the app name, support email, logo and your privacy policy and terms links, then publish it (set it to In production). While it is in testing, only listed test users can sign in.
Web client. Under Credentials, create an OAuth client of type Web application. The app asks Google for a sign-in token for this client, and the Fleetbase server checks the token against it. Copy its client id.
iOS client. Create an OAuth client of type iOS with the app's bundle id. Copy its client id.
Android client. Create an OAuth client of type Android with the app's package name (APP_IDENTIFIER) and the SHA-1 fingerprint of your signing key. With Google Play App Signing, add a second Android client with the SHA-1 from Play Console → App integrity too, or sign-in fails on installs from Google Play.
In .env, set the ids without the .apps.googleusercontent.com ending, and rebuild:
GOOGLE_LOGIN_ENABLED=true
GOOGLE_CLIENT_ID=123456789-abc… # the web client
GOOGLE_IOS_CLIENT_ID=123456789-def… # the iOS clientThe iOS build registers the com.googleusercontent.apps.<id> URL scheme from GOOGLE_IOS_CLIENT_ID on its own.
No Firebase configuration file is needed for Google sign-in; the Android client is matched by package name and fingerprint.
The Google button only appears when GOOGLE_LOGIN_ENABLED=true and GOOGLE_CLIENT_ID is set. A client id with the .apps.googleusercontent.com ending doubles it up and sign-in fails.
Deleting an account
Customers can delete their account from the app, as the App Store and Google Play require: they ask, confirm with a code sent to their phone, and the account is closed. See Customer Authentication → Account Closure.