Hybrid IoT Architecture on GCP with EMQX and Firestore

Developers of mobile IoT applications on GCP often need to ensure bidirectional real-time communication between hundreds of devices and mobile clients. Telemetry from sensors arrives at up to 1000 messages per second, and latency above 500 ms renders the system useless for critical scenarios. Additionally, the MQTT broker must authenticate each device without embedding secrets into the client. Google Cloud IoT Core simplified this, but its shutdown forced the search for alternatives. We have implemented a hybrid architecture on EMQX, Cloud Pub/Sub, and Firestore for 20+ projects with fleets ranging from 100 to 5000 devices. Our GCP-certified engineers guarantee 99.9% uptime. Below are working schemas and specific configurations proven in production. If you need a reliable IoT infrastructure — get a consultation. Our engineers prepare an architecture in 2 days.

How to Integrate Google Cloud IoT into a Mobile App

The key challenge is to ensure bidirectional communication between devices and the mobile client with minimal latency. The solution is a hybrid architecture based on a self-hosted MQTT broker, Cloud Pub/Sub, and Firestore. Below we break down working schemas.

Problems We Solve

• Devices send telemetry (up to 1000 messages per second), but the mobile app does not receive it in real time — latency over 2 seconds is unacceptable.
• Need for feedback: send a command to the device (e.g., open a valve) with acknowledgment of execution.
• Push notifications about events do not arrive or arrive late, which is critical for security systems.
• Security: embedding Service Account keys in the client is not allowed — we use JWT tokens from Firebase Auth.
• Migration from the discontinued IoT Core — fear of vendor lock-in and migration complexity.

Each problem has a ready-made solution in the GCP stack. We use Firestore as a unified gateway between devices and the mobile client, and the MQTT broker for telemetry collection.

Alternatives to Google Cloud IoT Core

Google recommends several paths:

1. MQTT bridge via Cloud Pub/Sub directly with a self-hosted broker (EMQX, HiveMQ, Mosquitto). EMQX offers 2x higher throughput compared to Mosquitto under equal resources.
2. Partner platforms — Clearblade IoT Core, Cognite. Migrating to Clearblade minimally changes client code.
3. Other clouds — AWS IoT Core or Azure IoT Hub. But if you stay in GCP, the hybrid scheme is 30–50% more cost-effective.

We most often recommend Cloud Pub/Sub + EMQX for clients who wish to remain in GCP.

Mobile App Architecture on GCP

For the mobile client, direct connection to Cloud Pub/Sub via gRPC requires Google Cloud credentials, which cannot be embedded in the app. We use Firebase Authentication + Cloud Firestore as the transport layer for IoT states.

Workflow (proven on a fleet of 500+ devices):

1. IoT devices publish telemetry → MQTT broker (EMQX) → Cloud Pub/Sub (via Rule Engine).
2. Cloud Function reads from Pub/Sub and writes to Firestore.
3. Mobile app (Flutter/React Native) subscribes to Firestore changes via snapshots().
4. Commands from the app are written to the commands collection → Cloud Function publishes them back to the MQTT broker.
5. Push notifications about critical events — via FCM.

Latency from event to app update — under 500 ms (in a typical configuration). Up to 40% cost savings compared to a pure MQTT gateway without Pub/Sub.

Flutter implementation:

FirebaseFirestore.instance .collection('devices') .doc(deviceId) .snapshots() .listen((snapshot) { final state = DeviceState.fromJson(snapshot.data()!); // update UI }); 

React Native — similar via @react-native-firebase/firestore.

Architecture Comparison

How to Choose an MQTT Broker for Google Cloud IoT?

EMQX — our choice for production: Rule Engine reduces latency and eliminates extra Cloud Functions.

Cloud Run + MQTT for IoT

A more production-ready architecture: EMQX or HiveMQ on Cloud Run / GKE → Cloud Pub/Sub → Cloud Functions → Firestore. EMQX supports Rule Engine (analogous to AWS IoT Rules): you can publish directly from the broker to Pub/Sub based on conditions without separate Cloud Functions.

The mobile client connects to EMQX via MQTT over WebSocket with JWT authentication (issued by Firebase Auth). EMQX validates the token through an HTTP Authentication hook — a call to your backend on each connection.

Why Hybrid Architecture EMQX + Firestore Is More Cost-Effective?

Pure MQTT without Pub/Sub leads to message loss under overload and complex integration with mobile clients. Firestore as a buffer ensures at-least-once delivery and simplifies state tracking. According to our measurements, this mixed scheme is 40% cheaper under the same load. Contact us for an audit of your IoT project — we will choose the optimal architecture.

Firebase Cloud Messaging for IoT Events

Push notifications for IoT events are a native strength of the GCP stack. A Cloud Function triggered by a Pub/Sub message sends an FCM notification via Admin SDK:

await admin.messaging().send({ token: userFcmToken, notification: { title: 'Motion sensor', body: 'Motion detected in the hallway' }, data: { deviceId: '...', eventType: 'motion' } }); 

On Flutter, firebase_messaging handles background notifications via the onBackgroundMessage handler. Important: on Android, the handler must be a top-level function, not a class method — otherwise a crash occurs when receiving a notification in a killed state.

How We Do It: Step-by-Step Plan

For a client with a 500+ device fleet (temperature sensors in logistics), we implemented:

1. Deployed EMQX on Cloud Run with vertical auto-scaling (handles 10,000 messages/s).
2. Configured Rule Engine — anomaly filter (temperature threshold exceeded) publishing only anomalies to Pub/Sub (data volume reduction of 3x).
3. Cloud Function writes anomalies to Firestore; normal data goes to BigQuery for analytics.
4. Mobile app on Flutter subscribes to Firestore via snapshots().
5. Commands (e.g., "cut power") are written to commands and delivered back via MQTT.
6. Push notifications for critical events — via FCM (delivery time <1 s).

Result: event-to-notification latency <500 ms, 40% savings on cloud costs compared to the previous pure MQTT architecture.

Typical Mistakes in GCP IoT Integration

• Embedding Service Account keys in IPA/APK — a serious security breach. Always use Firebase Auth + JWT.
• Ignoring Firestore limits: up to 1 MiB per document, up to 10,000 writes per second per database. For high-traffic scenarios — buffering via Pub/Sub.
• Lack of command delivery acknowledgment mechanism. Use a separate ack collection in Firestore for device feedback.

Scope of Work and Timelines

• Architectural documentation with data flow diagrams.
• Mobile app prototype with Firestore and FCM integration.
• MQTT broker configuration (EMQX/HiveMQ) with JWT authentication via HTTP Hook.
• Setup of Cloud Pub/Sub and Cloud Functions.
• Deployment and operation instructions.
• Client team training.

Timelines: basic architecture (MQTT broker + Pub/Sub + Firestore + mobile client) — 3–4 weeks. Adding push notifications and Cloud Functions automation takes another 1–2 weeks. Costs are calculated individually based on message volume and required compute resources.

If you are looking for a reliable IoT infrastructure on GCP — get a consultation. Our certified engineers prepare an architecture in 2 days.