MojoAuth vs Firebase Auth: choosing your platform as you outgrow Firebase

import { MojoAuth } from "@mojoauth/server-sdk";

const mojo = new MojoAuth({ apiKey: process.env.MOJOAUTH_API_KEY });

// send OTP
await mojo.email.sendOtp({ email: "user@example.com" });

// verify OTP
const { user, accessToken } = await mojo.email.verifyOtp({
  email: "user@example.com",
  otp: req.body.otp,
});

import { getAuth, sendSignInLinkToEmail, signInWithEmailLink }
  from "firebase/auth";

const auth = getAuth();
const actionCodeSettings = {
  url: "https://app.example.com/finishSignIn",
  handleCodeInApp: true,
};

// send link
await sendSignInLinkToEmail(auth, "user@example.com", actionCodeSettings);
window.localStorage.setItem("emailForSignIn", "user@example.com");

// on return URL
const result = await signInWithEmailLink(auth, email, window.location.href);

Honest observations from running both:

• Firebase Auth's mobile SDKs are excellent on iOS and Android with deep platform integration (silent sign-in, App Check, FCM token binding).
• MojoAuth's server SDKs require less ceremony for backend-only auth flows. No Firebase config object, no project initialization.
• Firebase Auth's email link flow requires client-side state management (localStorage), which is awkward for non-browser flows.
• MojoAuth ships native WhatsApp OTP on Enterprise. Firebase Auth requires you to roll your own with Cloud Functions and a third-party messaging provider.

1. Week 1: export and parallel run. Export Firebase users with the Firebase CLI (`firebase auth:export`). Includes UID, email, scrypt hash, and custom claims. Import into MojoAuth via the migration toolkit. Stand up MojoAuth in parallel behind a feature flag.
2. Week 2: rewrite token verification and cutover. Replace Firebase ID token verification with MojoAuth JWT verification in your backend. Update any Firestore security rules that reference auth context. Shift traffic incrementally with the feature flag.

Common pitfalls

• Firestore security rules using `request.auth.uid` need to be rewritten to use the new token issuer. Plan time for rule changes and rule-testing.
• Anonymous Firebase users do not have a clean equivalent on MojoAuth. If you rely on anonymous-to-permanent upgrade flows, design a custom equivalent before cutover.
• Cloud Functions that depend on Firebase Auth triggers (`onCreate`, `onDelete`) need replacement with MojoAuth webhooks.
• App Check integration is Firebase-specific. Plan an alternative bot-protection strategy if you depend on it.