Code on the server

Play this lesson

Code players can't touch

Anything inside a game on the player's device can be read and changed with the browser's developer tools. So some code must run somewhere players can't reach.

Cloud Functions for Firebase are small pieces of our own JavaScript that run on Google's servers when something happens. We write them in a functions folder, test them, and upload them with firebase deploy --only functions. From then on, Google runs them for us, as often as needed.

What wakes a function up?

The event that starts a function is called its trigger.

Calling a function from the game

A callable function is one the game calls by name. In the game:

const submit = httpsCallable(functions, "submitScore");
await submit({ score: 48200, seconds: 660 });

On the server, the function gets request.data (the score) and request.auth.uid (who sent it, checked by Firebase, so it can't be faked). It runs with the Admin SDK, which skips Security Rules. So the rules can say "players may never write scores", and only our function can.

Bug hunt

functions/index.js
exports.submitScore = onCall(async (request) => {  if (!request.auth) {    throw new HttpsError("unauthenticated", "Log in");  }  const { score, seconds } = request.data;  if (score > seconds * 100) {    throw new HttpsError("invalid-argument", "No");  }  await db.collection("scores").add({    uid: request.auth.uid, score, seconds,  });});

Top pilots earn about 83 points a second. Which line stops a fake 99999 score from a 2-minute run?

  1. Line 2
  2. Line 5
  3. Line 6
  4. Line 9
Show the answer

Line 6

Line 6 allows at most 100 points a second, a little above the best pilots. A 2-minute run can reach 12,000 at most, so 99999 is refused. Line 2 only checks that someone is logged in.

Why the server is safer

The rules for a fair score now live in one place that players can't see or change. If a cheater finds a trick, we fix the function once and every player is protected, without a game update.

Functions can also hold secrets, like a payment key, that must never be inside the game. And a scheduled function can do jobs nobody should do by hand, like building a cached top 10 every 5 minutes, so players read one document instead of ten.

Pick the trigger

Kai wants the daily Hyper Shards board rebuilt into one document every 5 minutes, even when nobody is playing. Which trigger fits?

  1. An HTTPS call from the game
  2. A schedule
  3. A write to a player's save
Show the answer

A schedule

A schedule runs on a timer, whether or not anyone is playing. An HTTPS call only runs when the game asks, and a save write only runs when a player saves.

Functions need the Blaze plan

Cloud Functions only work on Firebase's pay-as-you-go Blaze plan. At the time of writing it still includes a free monthly allowance (around 2 million calls), but it needs a billing account and a payment card. A billing account is a contract, so a parent sets it up with us.

We also add a budget alert that emails us if costs pass a limit. An alert only warns. A newer spend cap (in preview at the time of writing) can pause our functions for the month at the limit. And we test functions on our own computer first, with the free Firebase Emulator Suite.

Cold starts

When nobody has called a function for a while, Google switches off its copy, called an instance, to save power. The next call must start a fresh one: load Node.js, load our code, connect to the database. This delay is a cold start, often around a second.

For a score sent at the end of a run, that's fine. To avoid it, we can set minInstances: 1 to keep one instance warm, but a warm instance costs money even when idle. And a function never belongs inside the 60 FPS game loop.

Quick check

The first score sent in the morning takes a second longer than the rest. What is the most likely reason?

  1. A cold start: Google had to start a fresh instance of the function
  2. The player's UID changed overnight
  3. Security Rules block the first score of each day
Show the answer

A cold start: Google had to start a fresh instance of the function

After a quiet night, no instance is running, so the first call waits while one starts. Later calls reuse the warm instance and are quick.

A referee in the cloud

Cloud Functions are our referee: code on Google's servers, woken by a call, a database write or a timer, that players can't touch. Safer scores, cached boards and secret keys all live there.

Functions are made for short jobs, though. Next: what a studio does when it needs a server that keeps running, like a live game server.

Bolt says: If it decides who wins or what something costs, it belongs on the server.

Fact-checked 9 October 2026