Short answer
Trim the email before you call Firebase, and log the exact value you pass. Check the field is wired to the right state and is not empty when the button is pressed. Validate the format in the form, and catch auth/invalid-email with a plain message.
Why Firebase rejects the email, and the fix
01
A space before or after the address
“Thrown if the email address is not valid.” Firebase, firebase.auth.Auth (signInWithEmailAndPassword)
Phone keyboards and autofill often add a trailing space after the address. Trim the value before every Firebase call. In Flutter the code is invalid-email, without the auth/ prefix.
const cleanEmail = email.trim(); try { await signInWithEmailAndPassword(auth, cleanEmail, password); } catch (e) { if (e.code === 'auth/invalid-email') { showMessage('Check the email address.'); } }02
The value is empty or comes from the wrong variable
“The email address is badly formatted.” GitHub, firebase-js-sdk auth error messages
If the input is not bound to state, or the handler reads an old copy of it, Firebase gets an empty or stale value, which can come back as invalid-email (or missing-email on some methods). Log the value right before the call. Also check the argument order: with the modular SDK, auth comes first, then email, then password.
03
The format really is wrong
A missing @, a comma instead of a dot, or a pasted display name like “Ana <ana@example.com>”. Use an email input type and a light format check in the form, then let Firebase decide the rest.
04
Creating or updating users with the Admin SDK
“The provided value for the email user property is invalid. It must be a string email address.” Firebase, Admin Authentication API errors (auth/invalid-email)
On the server, createUser and updateUser reject a bad email with the same code. Imported data often has spaces or empty strings, so clean it first.
Checked against the vendor’s docs on : Firebase reference: firebase.auth.Auth error codes; Firebase docs: Admin Authentication API errors; firebase-js-sdk: auth error messages.
Rather hand it over?
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
- from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start
Related: Firebase auth/weak-password · Firebase auth/invalid-credential · Supabase “Email address is invalid” · Firebase auth/email-already-in-use