Mobile Backend, APIs and Firebase Interview Questions for Mobile App Development
25 Mobile Backend, APIs and Firebase questions with answers for mobile app development roles — 7 easy, 10 medium, 8 hard.
About Mobile Backend, APIs and Firebase
Every app depends on a backend for data, login and notifications. Learn REST and GraphQL clients, token authentication, OTP login, Firebase and Supabase services, security rules, push notifications, payments, offline-first sync, conflict resolution and file uploads. Scenario questions about failures, security and data consistency are common in product company interviews.
Sheet progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Teams build custom REST or GraphQL APIs with Node.js, Java Spring Boot, Python or Go, hosted on cloud platforms. Backend-as-a-Service options like Firebase and Supabase provide authentication, databases, storage, functions and push notifications without managing servers, which suits startups and MVPs. Larger apps often combine a custom backend for business logic with managed services for auth, analytics and messaging.
02
What is Firebase and which services do mobile apps commonly use?
Firebase is a mobile and web development platform. Commonly used services are Authentication for email, phone OTP and social logins; Cloud Firestore and Realtime Database for synced data; Cloud Storage for files; Cloud Functions for server code; Cloud Messaging for push notifications; Crashlytics for crash reports; Analytics; Remote Config for feature flags; and App Distribution for testers. FlutterFire and React Native Firebase provide SDKs.
03
What local storage options exist for Flutter and React Native apps?
For simple key-value settings, Flutter uses shared_preferences and React Native uses AsyncStorage or MMKV. For sensitive data, flutter_secure_storage or expo-secure-store use Keychain and Keystore. For structured data and queries, use SQLite via sqflite or drift in Flutter and expo-sqlite or WatermelonDB in React Native. Object stores like Isar, Hive or Realm also exist, but check maintenance status before choosing.
04
Where should you keep API keys and secrets in a mobile app?
Anything bundled in a mobile app can be extracted by decompiling, so never ship true secrets like payment secret keys or admin credentials. Keep them on your backend and let the app call your server. Public client keys, such as maps or Firebase config, are acceptable but should be restricted by app package name, bundle ID and certificate fingerprint. Use environment configuration in CI rather than committing keys to the repository.
05
How do you handle API errors gracefully in the UI?
Map errors into categories in the data layer: no internet, timeout, server error, unauthorised and validation errors with field messages. The UI shows a friendly message and a retry action for network issues, inline messages for validation, and redirects to login for unauthorised. Keep cached data visible when refresh fails. Log unexpected errors to crash reporting with request context but never sensitive data.
06
Tell me about a time you worked with a backend developer to fix an integration issue.
Situation: our app showed wrong prices after a discount launch. Task: find whether the app or API was at fault. Action: I captured the failing request and response with a proxy, shared it with the backend developer, and we found the API returned paise in one endpoint and rupees in another. We agreed on one format, updated the contract document and added a test. Result: the bug was fixed the same day.
07
What is the difference between a BaaS and a custom backend for a mobile startup?
A Backend-as-a-Service gives ready authentication, database, storage and functions, so a small team launches faster without managing servers, and costs stay low at small scale. A custom backend gives full control over business logic, data model, integrations and cost at large scale, but needs more engineering effort. Many startups begin with BaaS for the MVP and gradually move complex or expensive parts to custom services.
08
How do you secure Cloud Firestore data accessed directly from a mobile app?
Because the app talks to the database directly, security rules are the backend. Write rules that check request.auth for authentication and that users can read or write only their own documents, for example allow read, write: if request.auth.uid == userId. Validate fields and types in rules, never leave test mode rules open, and move sensitive operations like payments or role changes to Cloud Functions. Test rules with the emulator suite.
09
How does token-based authentication work in mobile apps?
The user signs in and the server returns a short-lived access token, often a JWT, and a longer-lived refresh token. The app stores them securely in Keychain or Keystore-backed storage and sends the access token in the Authorization header. When it expires, the app uses the refresh token to get a new one, retrying the failed request. On logout, tokens are deleted and ideally revoked on the server.
10
Write a Dart HTTP client using dio with an interceptor that adds an auth token.
The app registers with the platform push service, FCM on Android and APNs on iOS, often both through FCM, and receives a device token. The app sends this token to your backend, linked to the user. When an event happens, the backend sends a message to FCM or APNs with the token, which delivers it to the device. The app requests notification permission, handles taps to open the right screen, and refreshes tokens when they change.
12
What is the difference between REST and GraphQL for mobile clients?
REST exposes resources at fixed endpoints, which can lead to over-fetching or many round trips for one screen. GraphQL exposes one endpoint where the client asks exactly for the fields it needs, reducing payload size and requests, which helps on slow mobile networks. GraphQL adds complexity in caching, error handling and server performance. Clients like Apollo or graphql_flutter provide normalised caching and code generation.
13
How do you implement OTP login with a phone number?
The user enters a phone number, the backend or an auth service sends an OTP via SMS and returns a verification ID. The user enters the code, which is verified to issue session tokens. On Android, use the SMS Retriever or User Consent API to auto-read the code without SMS permissions; on iOS, set the text content type to one-time code for autofill. Rate-limit requests, expire codes quickly and protect against abuse.
14
Push notifications arrive on Android but not on iOS. How do you debug it?
Check that the push notifications capability and background modes are enabled in Xcode, that an APNs authentication key is uploaded to the push provider, and that notification permission was granted. Verify the app gets an APNs token and the provider token, and that the right environment, development or production, is used. Test on a real device, since simulators have limited push support, and check payload format.
15
The API responses are slow on mobile networks. What can the mobile team ask the backend team to change?
Ask for pagination with sensible page sizes, gzip or brotli compression, removing unused fields or providing screen-specific endpoints, and aggregated endpoints to avoid multiple sequential calls. Request proper cache headers and ETags so the client can reuse responses. Ask for resized images through a CDN and HTTP/2 or HTTP/3 support. Share measured timings from real devices to justify the requests.
16
How do you handle pressure when a production issue affects many users?
I stay calm and focus on reducing impact first: confirm the issue, communicate status to the team, and look for the fastest safe mitigation such as a remote config switch, server-side fix or pausing a rollout. Then I find the root cause, ship a proper fix and write a short postmortem. Clear, regular updates to stakeholders reduce panic and let others plan around the issue.
17
What is Supabase and how does it compare to Firebase?
Supabase is an open-source backend platform built on PostgreSQL, offering authentication, a relational database with auto-generated APIs, row level security, storage, edge functions and real-time subscriptions. Firebase uses NoSQL databases like Firestore. Supabase suits apps with relational data and SQL needs, and can be self-hosted, while Firebase has a richer mobile ecosystem including Crashlytics, Remote Config and FCM. Many apps combine them.
Store data in a local database and render the UI from it, so the app works without network. Queue user changes locally with a pending status and sync them in the background when connectivity returns, using retries with backoff. Fetch server changes using timestamps or sync tokens and merge them. Resolve conflicts with clear rules like last write wins or server authority, and show sync status to users.
19
How do you integrate a payment gateway in a mobile app safely?
Create the order on your backend with the amount, get an order ID, and open the gateway's SDK checkout in the app with that ID. After payment, the SDK returns a payment ID and signature, which the app sends to the backend to verify with the secret key before marking the order paid. Rely on server-side webhooks as the final truth. Never keep secret keys in the app or trust client-side success alone.
20
Write a React Native function that uploads an image with progress using Expo FileSystem.
A common cause is a race condition: several requests receive 401 at once and each triggers a refresh, so later refreshes use an already rotated refresh token and fail, logging the user out. Fix it by allowing only one refresh at a time and queueing other requests until it completes, then retrying them with the new token. Also check device clock issues, token expiry settings and secure storage read failures.
22
The Firestore bill is growing fast because of too many reads. How do you reduce it?
Find screens that listen to large collections or re-read data on every rebuild. Paginate queries with limits, listen only to needed documents, detach listeners when screens close, and avoid starting listeners inside build methods. Denormalise data to reduce reads per screen, cache data locally with offline persistence, and use aggregate count queries instead of reading all documents to count. Monitor usage per collection.
23
A payment shows success in the app but the order is not created on the server. How would you fix the flow?
The app is probably treating the SDK's success callback as final and the verification call failed or was never sent, for example when the app was killed. Make the backend the source of truth: verify payments with the gateway's signature on the server and use webhooks to update orders even if the app never reports back. The app should poll order status after payment and show a pending state until confirmed.
24
Your app must show live delivery partner location on a map. How would you design it?
The partner app sends location updates every few seconds through a foreground service to the backend, which publishes them to a real-time channel like WebSockets or Firestore documents. The customer app subscribes only while the tracking screen is open and smoothly animates the marker between points. Throttle updates, reconnect on network changes, and fall back to polling. Stop tracking when the delivery completes to save battery.
25
Two users editing the same shared list offline create conflicting changes. How do you resolve conflicts?
Choose a strategy based on data. Last write wins, using server timestamps, is simple but can lose edits. Field-level merging keeps non-conflicting changes. For lists, treat each item as a separate record with its own version so edits rarely clash. For collaborative content, CRDT-based approaches merge automatically. Always let the server decide final order, and show users when their change was overwritten.
Frequently asked questions
How important is Mobile Backend, APIs and Firebase in Mobile App Development interviews?
Every app depends on a backend for data, login and notifications. Learn REST and GraphQL clients, token authentication, OTP login, Firebase and Supabase services, security rules, push notifications, payments, offline-first sync, conflict resolution and file uploads. Scenario questions about failures, security and data consistency are common in product company interviews.
How should I use the Mobile Backend, APIs and Firebase sheet?
Go top to bottom — easy to hard. Answer before opening each answer, tick what you solved and save misses to Last-Minute Revision.