Firebase Auth errorFirebase Auth: auth/invalid-verification-code

Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.

Why Firebase rejects the code, and the fix

1. 01

   The user typed the wrong code

   “sign in the user by passing the code to the confirm method of the ConfirmationResult object” Firebase, Phone authentication (web)

   Six digits are easy to mistype. Show a clear message, keep the input, and offer a resend after a short wait.

   try {
     const result = await confirmationResult.confirm(code.replace(/\s/g, ''));
   } catch (error) {
     if (error.code === 'auth/invalid-verification-code') {
       showMessage('That code doesn’t match. Check the SMS or request a new code.');
     }
   }

2. 02

   An old code after a resend

   After a resend, the user may type the code from the first SMS, which belongs to the earlier verification. Always confirm against the newest ConfirmationResult, and tell the user to use the latest message.

3. 03

   The wrong verification ID is used

   On Android and iOS, an app restart or a screen rebuild can drop the verification ID or leave an older one in use. A missing or invalid ID gives auth/missing-verification-id or auth/invalid-verification-id; an older ID with a new code fails as a mismatch. Keep the latest ID somewhere that survives.

4. 04

   A fictional test number uses its own code

   “You can set up fictional phone numbers for development using the Firebase console.” Firebase, Test with fictional phone numbers

   Also check: test numbers set in the console only accept the code you set there. No real SMS is sent to them.

Checked against the vendor’s docs on November 9, 2026: Firebase docs: Phone authentication (web).

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

• from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
• from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start

Related: Firebase auth/invalid-phone-number · Firebase phone auth invalid-app-credential · Firebase auth/missing-or-invalid-nonce · Firebase auth/invalid-action-code