title: Phone Authentication Validation from Server Side Firebase + PHP
body: <p>I'm Creating a custom User Management system, involves all the App data to be on application server, but the phone should be authenticated by firebase. When New User Register on System, Firebase Phone Authentication takes place. On successful authentication from firebase, Registration Data goes to Server via API. Now the Problem is, how do I check server side that the phone number is authenticated by firebase or not? If I allow registration without server-side firebase auth validation, API Request can be spoofed by someone. I'm currently using <code>kreait/firebase-php ^4.18</code> Firebase SDK for PHP.
  The Flow I'm Using Right Now is Demonstrated below<a href="https://i.stack.imgur.com/ARimw.png" rel="noreferrer"><img src="https://i.stack.imgur.com/ARimw.png" alt="Currunt Flow of Registration"></a> and the flow I want to implement is also can be given as,
  <a href="https://i.stack.imgur.com/a3f6X.png" rel="noreferrer"><img src="https://i.stack.imgur.com/a3f6X.png" alt="Proposed Solution to Secure the Registration flow."></a></p>
  
  <p><strong><em>Update 25/09/2019</em></strong></p>
  
  <p>The library <code>Kreait\Firebase</code> helped to achieve to implement flow as given in answer by @jeromegamez in the accepted answer, However, the <code>Kreait\Firebase</code> does not support the <code>idToken</code> validation for ios device.
  IOS device has google idToken rather having firebase IdToken and hence <code>Kreait\Firebase</code> failed to validate it. Brief issue is given in <a href="https://stackoverflow.com/questions/57724796/firebase-ios-idtoken-invalid-kid-exception-in-backend-while-verifyidtoken-in">Firebase IOS idToken invalid <code>kid</code> Exception in the backend while <code>verifyIdToken</code> in Gmail Auth</a> post.</p>