How to Implement Server-Side Logic in a FlutterFlow App

Not everything needs to run server-side — move logic to Cloud Functions only when it falls into one of these categories. First, secret key usage: Stripe's secret key, email provider API keys, OpenAI API keys, and any credential that would expose your accounts if it appeared in client code. Second, trusted computations: order totals, subscription checks, user role assignments, and any number the user should not be able to falsify. Third, side effects: sending emails, SMS, push notifications, or writing to multiple Firestore documents atomically using a transaction. Fourth, third-party webhooks: Stripe payment webhooks, Twilio callbacks, and other external service notifications arrive via HTTP POST to your server. Understanding these categories helps you decide exactly which actions stay in FlutterFlow's visual Action Flows and which need a Cloud Function.

Callable functions (functions.https.onCall) are the preferred way to call Cloud Functions from FlutterFlow because they automatically include the caller's Firebase Authentication token in every request. This means context.auth in your function contains the verified user ID — no need to pass tokens manually or write authentication middleware. Create a function like processPayment that accepts a data object with priceId and calls the Stripe API using your secret key (stored as a Cloud Function environment variable). Return a JSON result. Deploy with firebase deploy --only functions:processPayment. In FlutterFlow, call the function using an API Call action with method POST to your function's callable URL, or use the Firebase Functions integration in FlutterFlow's API Manager.

1// Cloud Function: processPayment (callable)
2// Receives: { priceId: string }
3// Returns: { clientSecret: string }
4const functions = require('firebase-functions');
5const admin = require('firebase-admin');
6const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
7
8if (!admin.apps.length) admin.initializeApp();
9
10exports.processPayment = functions.https.onCall(async (data, context) => {
11  // Verify the user is authenticated
12  if (!context.auth) {
13    throw new functions.https.HttpsError(
14      'unauthenticated',
15      'Must be signed in to make a payment'
16    );
17  }
18
19  const { priceId } = data;
20  if (!priceId) {
21    throw new functions.https.HttpsError('invalid-argument', 'priceId is required');
22  }
23
24  // Create a PaymentIntent via Stripe
25  const paymentIntent = await stripe.paymentIntents.create({
26    amount: 2999, // $29.99 in cents
27    currency: 'usd',
28    metadata: { userId: context.auth.uid, priceId },
29  });
30
31  return { clientSecret: paymentIntent.client_secret };
32});

In FlutterFlow, open the API Manager (Settings → API Calls → Add API Call). Set the method to POST and the URL to your Cloud Function's URL. Add a Header: Authorization with value Bearer [current_user_auth_token]. Add the request body as JSON with the required parameters. Add a JSON Body field for data (e.g. {"data": {"priceId": "price_123"}}). Note: Firebase callable functions expect the payload wrapped in a data key. Save the API call and give it a name like CallProcessPayment. In your payment button's Action Flow, add a Backend API Request action using this configured call. After a successful response, read the clientSecret from the response body using FFAppState or a Page State variable and pass it to the Stripe payment sheet.

Firestore triggers fire a Cloud Function automatically when a document is created, updated, or deleted — without any client involvement. This is perfect for automated side effects: send a welcome email when a user document is created, calculate order totals when a cart item document is added, or send a push notification when a chat message document is created. Use functions.firestore.document('orders/{orderId}').onCreate() for create triggers. The function receives the new document's data via change.after.data(). Use the admin SDK to read related documents, perform calculations, and write back results. These triggers run even if the user closes the app immediately after creating the document.

1// Cloud Function: onOrderCreated (Firestore trigger)
2// Fires when a new document is created in the orders collection
3const functions = require('firebase-functions');
4const admin = require('firebase-admin');
5
6exports.onOrderCreated = functions.firestore
7  .document('orders/{orderId}')
8  .onCreate(async (snap, context) => {
9    const order = snap.data();
10    const orderId = context.params.orderId;
11
12    // Calculate order total from line items
13    const itemsSnap = await admin.firestore()
14      .collection('orders').doc(orderId)
15      .collection('items').get();
16
17    const total = itemsSnap.docs.reduce(
18      (sum, doc) => sum + (doc.data().price * doc.data().quantity), 0
19    );
20
21    // Write total back to the order document
22    await snap.ref.update({ total, status: 'confirmed' });
23
24    // Send confirmation email (using your email provider)
25    await sendConfirmationEmail(order.userEmail, orderId, total);
26
27    return null;
28  });

Unlike callable functions, HTTP trigger functions (onRequest) do not automatically verify authentication. They receive a raw HTTP request and can be called by anyone who knows the URL. If you use onRequest for internal app logic (not for public webhooks), always validate the Authorization header manually. Extract the Bearer token from req.headers.authorization, call admin.auth().verifyIdToken(token), and reject requests where verification fails with a 401 response. For third-party webhooks like Stripe, verify the webhook signature using the provider's SDK instead of Firebase auth. Never skip authentication on onRequest functions that perform write operations.

1// HTTP trigger with authentication validation
2const functions = require('firebase-functions');
3const admin = require('firebase-admin');
4
5exports.secureEndpoint = functions.https.onRequest(async (req, res) => {
6  // Validate Firebase ID token
7  const authHeader = req.headers.authorization || '';
8  if (!authHeader.startsWith('Bearer ')) {
9    return res.status(401).json({ error: 'Unauthorized' });
10  }
11
12  try {
13    const token = authHeader.split('Bearer ')[1];
14    const decoded = await admin.auth().verifyIdToken(token);
15    // decoded.uid is the verified user ID
16    const uid = decoded.uid;
17
18    // Your logic here
19    res.json({ success: true, uid });
20  } catch (err) {
21    return res.status(401).json({ error: 'Invalid token' });
22  }
23});