AI & TechnologyFirebase Auth Errors: 9 Sign-In Fixes (2026)

Short answer: many Firebase Auth errors are settings, such as a domain that isn’t authorized, a sign-in method that is switched off or a signing key that isn’t registered. The rest are small code changes, such as handling a newer error code or initializing Firebase before the first call. Find your error code below; each one links to a full fix page checked against Firebase’s and Google’s documentation.

Firebase Auth errors come from three places: project settings, platform registration and how the app handles the error. The 9 errors below break sign-up, sign-in or account deletion on web, Android, iOS and Flutter apps, including apps generated by AI builders. Each fact comes from Firebase’s or Google’s documentation, as checked on the linked fix page, and the order of checks is App369’s advice.

Sign-in fails on the web

Web sign-in depends on the domain the app runs on, the sign-in methods switched on and how the browser treats popups. These four errors are specific to the web.

auth/invalid-credential

Email enumeration protection is on, so Firebase returns the same error for a wrong email and a wrong password. According to the Firebase JS SDK reference, “When Email Enumeration Protection is enabled, this method fails with “auth/invalid-credential” in case of an invalid email/password.” Projects created on or after September 15, 2023 have it on by default, so code that checks for user-not-found never reaches that branch. Show one message for both. Full steps: Firebase auth/invalid-credential.

auth/unauthorized-domain

The domain the app runs on isn’t on the Authorized domains list. Firebase’s Authentication FAQ says: “In projects created after April 28, 2025, Firebase Authentication no longer includes localhost as an authorized domain by default.” Add your custom domain, the www version if you use it, and the preview domains you test on. Full steps: Firebase auth/unauthorized-domain.

auth/operation-not-allowed

The sign-in method your code calls is switched off. Each method (email and password, email link, phone, anonymous, and each social provider) is a separate switch on the Sign-in method tab, and email link sign-in also needs email and password turned on. App369 also checks that the app’s Firebase config points at the project where the method is enabled, since staging and production are often separate projects. Full steps: Firebase auth/operation-not-allowed.

auth/popup-blocked

The browser blocked the Google sign-in popup because other work ran before it. A click gives the page a short window to open a popup, and awaiting a fetch or a database read first can use it up. Make signInWithPopup the first call in the click handler. Full steps: Firebase auth/popup-blocked. If Google sign-in shows “Error 400: redirect_uri_mismatch” instead, see the redirect_uri_mismatch fix.

Too many attempts

Firebase rate-limits sign-ups and SMS codes, and testing often hits the limits before real users do.

auth/too-many-requests

Firebase limits how fast accounts are created and how many SMS codes go to one number. The Firebase Authentication limits page lists “100 accounts/hour for each IP address”, which a test script or a launch event on one Wi-Fi network can reach. For testing phone sign-in, add fictional phone numbers with fixed codes in the Firebase console. Full steps: Firebase auth/too-many-requests.

Google Sign-In fails on Android or iOS

Mobile Google Sign-In needs the app registered with Google: signing key fingerprints on Android, and client IDs in Info.plist on iOS. A missing registration fails the same way every time.

Google Sign-In error 10 on Android

Status code 10 is DEVELOPER_ERROR, a setup problem that retrying won’t fix. If it works in debug and fails from Google Play, the Play app signing key isn’t registered: the Play Console Help says “you must register the Google-held app signing key fingerprint with your API providers, not just your local upload key.” Also check the sign-in request uses the Web client ID. Full steps: Google Sign-In error 10.

iOS crash: “Make sure GIDClientID is set in Info.plist”

The Google Sign-In SDK reads your iOS OAuth client ID from Info.plist, and without the GIDClientID key it has no configuration. Add the iOS client ID (not the web one) and the custom URL scheme based on the reversed client ID. Full steps: Google Sign-In GIDClientID crash.

Flutter: “No Firebase App ‘DEFAULT’ has been created”

A Firebase call ran before Firebase.initializeApp finished. Make main() async and await initialization before runApp, and initialize again at the top of a background message handler, which runs in its own isolate. Full steps: No Firebase App DEFAULT.

Account deletion fails

Firebase requires a recent sign-in before an app deletes an account or changes a password or email.

auth/requires-recent-login

Deleting an account or changing a password or email needs a recent sign-in. The Firebase manage users guide says: “If you perform one of these actions, and the user signed in too long ago, the action fails with an error.” Ask the user to sign in again, call reauthenticateWithCredential, and retry. Apple requires apps with account creation to offer account deletion in the app, so a failing Delete account button can lead to an App Store rejection under Guideline 5.1.1(v). Full steps: Firebase auth/requires-recent-login.

Which to check first

The fastest route is the exact error code first, then the Firebase console settings, then the platform registration. App369’s full order for an app where Firebase sign-in just broke:

1. Log the full error code (auth/... on the web, the status code on Android); most of the errors above have a distinct one.
2. In Authentication settings, check the sign-in method is on and the domain is authorized, in the project the app actually uses.
3. On Android, compare the SHA-1 fingerprints in Firebase with the debug key and the Play app signing key.
4. On iOS, check GIDClientID and the reversed client ID URL scheme in Info.plist.
5. Try the flow on the live build with a new account and with an old one.

The Firebase errors and fixes page lists every Firebase fix, including Firestore rules and Cloud Functions. For a step-by-step method on any Flutter and Firebase bug, see how to debug a Flutter Firebase bug. For Firestore, Storage, Cloud Functions and push errors, see the Firestore and Cloud Functions errors guide.

Need a hand?

App369 fixes single sign-in bugs at a fixed price. If one bug is the whole problem, the App Fix Ticket covers it in two fixed-price steps: a $450 diagnosis that finds the root cause and gives you a fixed quote for the fix, then the fix itself. If the app was built with an AI builder and more is going on, the AI-Built App Rescue starts with a Launch Check of the whole app. Or describe the problem and get a written quote.