Authentication FAQ and troubleshooting

How can I prevent SMS abuse when using phone authentication?

To help protect your project from SMS traffic pumping and API abuse, take the following steps:

Consider setting an SMS region policy

1. View your regional SMS usage.

   Look for regions with a very high number of sent SMS and a very low number (or zero) of verified SMS. The ratio of verified/sent is your success rate. Healthy success rates are commonly in the 70-85% range since SMS is not a guaranteed delivery protocol, and some regions may experience abuse. Success rates lower than 50% imply many sent SMS but few successful logins, which is a common indicator of bad actors and SMS traffic pumping.

2. Use SMS Region Policy to either deny SMS regions with low success rates, or only allow certain regions if your app is only intended for distribution in certain markets.

Limit your authorized authentication domains

Use the Authentication settings dashboard to manage authorized domains. The localhost domain is added by default to the approved authentication domains to simplify development. Consider removing localhost from the authorized domains in your production project to prevent bad actors from running code on their localhost to access your production project.

Enable and enforce App Check

Enable App Check to help protect your project from API abuse by attesting that requests only come from applications associated with your project.

To use App Check with Firebase Authentication, you must upgrade to Firebase Authentication with Identity Platform.

Remember that you need to enforce App Check for Authentication in the Firebase console (consider monitoring traffic before enforcing). Also, double check your reCAPTCHA Enterprise approved sites list to validate that it only contains your production sites, and that the list of applications registered to your project in App Check is accurate.

Note that App Check helps protect against automated attacks by asserting that the call comes from one of your registered applications. It does not prevent users from using your app in unintended ways (for example, starting then never finishing login flows to generate sent SMS).

Are phone numbers ported to a new carrier supported by phone authentication?

At this time, numbers ported between carriers will result in all SMS becoming undeliverable for those end users. There is no workaround, and Firebase is working on this issue.

In my Android app, why am I getting the following error:
Google sign in failed?

Follow the troubleshooting steps in this FAQ if you're getting the following error:

GoogleFragment: Google sign in failed
    com.google.android.gms.common.api.ApiException: 13: Unable to get token.
        at
com.google.android.gms.internal.auth-api.zbay.getSignInCredentialFromIntent(com.google.android.gms:play-services-auth@@20.3.0:6)

1. Make sure that Google sign-in is properly enabled as an authentication provider:

   1. In the Firebase console, open the Authentication section.

   2. Within the Sign in method tab, disable and then re-enable the Google sign-in method (even if it's already enabled):

      1. Open the Google sign-in method, disable it, and then click Save.

      2. Re-open the Google sign-in method, enable it, and then click Save.

2. Make sure that your app is using its up-to-date Firebase configuration file (google-services.json).
   Obtain your app's config file.

3. Check if you're still getting the error. If you are, continue to the next troubleshooting step.

4. Make sure the required underlying OAuth 2.0 clients are present.

   1. In the Credentials page of the Google Cloud console, look in the OAuth 2.0 Client IDs section.

   2. If OAuth 2.0 clients are not present (and you've done all the troubleshooting steps above), then contact Support.

In my Apple platform app, why am I getting the following error:
You must specify <clientID> in <GIDConfiguration>?

Follow the troubleshooting steps in this FAQ if you're getting the following error:

You must specify |clientID| in |GIDConfiguration|

1. Make sure that Google sign-in is properly enabled as an authentication provider:

   1. In the Firebase console, open the Authentication section.

   2. Within the Sign in method tab, disable and then re-enable the Google sign-in method (even if it's already enabled):

      1. Open the Google sign-in method, disable it, and then click Save.

      2. Re-open the Google sign-in method, enable it, and then click Save.

2. Make sure that your app is using its up-to-date Firebase configuration file (GoogleService-Info.plist).
   Obtain your app's config file.

3. Check if you're still getting the error. If you are, continue to the next troubleshooting step.

4. Make sure the required underlying OAuth 2.0 clients are present.

   1. In the Credentials page of the Google Cloud console, look in the OAuth 2.0 Client IDs section.

   2. If OAuth 2.0 clients are not present (and you've done all the troubleshooting steps above), then contact Support.

In my web app, why am I getting the following error:
AuthErrorCode.INVALID_OAUTH_CLIENT_ID?

Follow the troubleshooting steps in this FAQ if you're getting the following error:

AuthErrorCode.INVALID_OAUTH_CLIENT_ID

1. Make sure that Google sign-in is properly enabled as an authentication provider:

   1. In the Firebase console, open the Authentication section.

   2. Within the Sign in method tab, disable and then re-enable the Google sign-in method (even if it's already enabled):

      1. Open the Google sign-in method, disable it, and then click Save.

      2. Re-open the Google sign-in method, enable it, and then click Save.

2. Also, in the Google sign-in provider configuration of the Authentication section, make sure that the OAuth client ID and secret match the web client displayed in the Credentials page of the Google Cloud console (look in the OAuth 2.0 Client IDs section).

In my web app, why are sign-in with redirects failing with the following error:
This domain YOUR_REDIRECT_DOMAIN is not authorized to run this operation?

Follow the troubleshooting steps in this FAQ if you're getting the following error:

This domain YOUR_REDIRECT_DOMAIN is not authorized to run this operation.

This error is most likely caused because your redirect domain isn't listed as an authorized domain for Firebase Authentication, or the API key that you use with the Firebase Authentication Service is invalid.

First make sure that YOUR_REDIRECT_DOMAIN is in the list of authorized domains for your Firebase project. If your redirect domain is already listed there, continue to troubleshoot an invalid API key.

By default, Firebase Authentication JS SDK relies on the API key for your Firebase project that's labeled as the Browser key, and it uses this key to verify that a sign-in redirect URL is valid according to the list of authorized domains. Authentication gets this API key depending on how you access the Authentication SDK:

• If you use Hosting-provided Auth helpers to log users in with the Authentication JS SDK, then Firebase automatically obtains your API key with the rest of your Firebase configuration each time you deploy to Firebase Hosting. Make sure that the authDomain in your web app firebaseConfig is properly configured to use one of the domains for that Hosting site. You can verify this by going to https://authDomain__/firebase/init.json, and checking that the projectId matches that from your firebaseConfig.

• If you self-host the sign-in code, then you can use a __/firebase/init.json file to provide the Firebase configuration to the self-hosted Authentication JS SDK Redirect helper. The API key and the projectId listed in this config file should match your web app firebaseConfig.

Check to make sure this API key hasn't been deleted: Go to the APIs & Services > Credentials panel in the Google Cloud console where all the API keys for your project are listed.

• If the Browser key has not been deleted, check the following:

  • Make sure the Firebase Authentication API is in the list of allowed APIs for the key to access (learn more about API restrictions for API keys).

  • If you self-host the sign-in code, make sure the API key listed in your __/firebase/init.json file matches the API key in the Google Cloud console. Correct the key in the file, if necessary, then redeploy your app.

  • If the Browser key has been deleted, you can have Firebase generate a new API key for you: In the Firebase console, go to settings > Project settings, then in the Your apps section, click your web app. This action automatically creates an API key that you can see in the SDK setup and configuration section for your web app.

  Note that in the Google Cloud console this new API key won't be called Browser key; instead, it will be the same name as your Firebase Web App's nickname. If you decide to add API restrictions to this new API key, make sure the Firebase Authentication API is in the list of allowed APIs.

  Once your new API key is created, complete the applicable steps below:

  • If you use reserved Hosting URLs, then redeploy your app to Firebase so that it can automatically obtain the new API key with the rest of your Firebase configuration.

  • If you self-host the sign-in code, copy the new API key and add it to your __/firebase/init.json file, then redeploy your app.

How do I manually construct an OAuth web client?

1. Open the Credentials page of the Google Cloud console.

2. At the top of the page, select Create credentials > OAuth client ID.

3. If you're prompted to configure your consent screen, follow the on-screen instructions, and then continue with the following steps of this FAQ.

4. Create the OAuth web client:

   1. For the Application Type, select Web application.

   2. For the Authorized JavaScript Origins, add the following:

      • http://localhost
      • http://localhost:5000
      • https://PROJECT_ID.firebaseapp.com
      • https://PROJECT_ID.web.app

   3. For the Authorized Redirect URIs, add the following:

      • https://PROJECT_ID.firebaseapp.com/__/auth/handler
      • https://PROJECT_ID.web.app/__/auth/handler

   4. Save the OAuth client.

5. Copy the new OAuth client ID and client secret to your clipboard.

6. In the Firebase console, open the Authentication section.

7. Within the Sign in method tab, open the Google sign-in provider, and then paste the web server client ID and secret you just constructed and copied from the Google Cloud console. Click Save.

How is %APP_NAME% determined for the email template for the confirmation email that can be sent to a user when they sign up using an email address and password?

Before December 2022, the %APP_NAME% in the email template was populated with the OAuth brand name that was automatically provisioned whenever an Android app was registered in the Firebase project. Now, since the OAuth brand is provisioned only when Google sign-in is enabled, the following describes how %APP_NAME% is determined:

• If the OAuth brand name is available, then the %APP_NAME% in the email template will be the OAuth brand name (same as pre-December 2022 behavior).

• If the OAuth brand name is not available, here's how the %APP_NAME% in the email template is determined:

  • For web apps, the %APP_NAME% will be the default Firebase Hosting site name (the value preceding .firebaseapp.com and .web.app and usually the Firebase project ID).

  • For mobile apps:

    • If the Android package name or iOS bundle ID is present in the request, then the %APP_NAME% will be the app name used in the Play Store or App Store (respectively).

    • Otherwise, the %APP_NAME% will be the default Firebase Hosting site name (the value preceding .firebaseapp.com and .web.app and usually the Firebase project ID).

  Note that if the lookup of the default Firebase Hosting site name fails, then the final fallback is to use the Firebase project ID as the %APP_NAME%.