# Firebase Auth: auth/missing-or-invalid-nonce with Sign in with Apple

> Sign in with Apple fails with Firebase auth/missing-or-invalid-nonce. Send the SHA256 hash to Apple and the raw nonce to Firebase, from the same attempt.

Canonical: https://app369.com/fix/firebase-auth-missing-or-invalid-nonce/
Last updated: 2026-11-09

auth/missing-or-invalid-nonce is the Firebase Auth error when the nonce in an Apple ID token doesn’t match the one the app gives Firebase. Apple must get the SHA256 hash of a random nonce, and Firebase must get the raw nonce.

**Short answer**

For each sign-in, generate one random nonce. Pass its SHA256 hash, as a hex string, to the Apple request, and pass the raw nonce as rawNonce when you create the Firebase credential. On Flutter, signInWithProvider with AppleAuthProvider handles the nonce for you.

Rather not fix it yourself? [**App Fix Ticket**](https://app369.com/fixed-price/flutter-firebase-bug-fix/) starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.

## **Why Firebase rejects the nonce, and the fix**

1. 01 ### **The hashed nonce went to Firebase**
  > “You will send the SHA256 hash of the nonce with your sign-in request, which Apple will pass unchanged in the response.” [**Firebase, Sign in with Apple (iOS)**](https://firebase.google.com/docs/auth/ios/apple) The most common mix-up: the app passes the hash to both sides. Apple gets the hash; Firebase gets the original string.```
final rawNonce = generateNonce(); // your own helper: a random string per sign-in
final hashed = sha256.convert(utf8.encode(rawNonce)).toString();
final apple = await SignInWithApple.getAppleIDCredential(
  scopes: [AppleIDAuthorizationScopes.email, AppleIDAuthorizationScopes.fullName],
  nonce: hashed,
);
final credential = OAuthProvider('apple.com').credential(
  idToken: apple.identityToken,
  rawNonce: rawNonce,
);
await FirebaseAuth.instance.signInWithCredential(credential);
```
2. 02 ### **No nonce was sent to Apple**
  > “Firebase validates the response by hashing the original nonce and comparing it to the value passed by Apple.” [**Firebase, Sign in with Apple (iOS)**](https://firebase.google.com/docs/auth/ios/apple) Without a nonce in the Apple request, the ID token has nothing for Firebase to compare. Always set the nonce on the Apple request.
3. 03 ### **The nonce changed between request and sign-in** Generating a new nonce after the Apple sheet opens, or keeping it in a widget that rebuilt, breaks the match. Keep the raw nonce from that attempt until signInWithCredential finishes.
4. 04 ### **The hash is not a hex string** Also check: Firebase’s sample asks for the SHA256 hash as a hex string. Base64 or raw bytes won’t match what Firebase computes.

Checked against the vendor’s docs on November 9, 2026: [Firebase docs: Sign in with Apple (Apple platforms)](https://firebase.google.com/docs/auth/ios/apple).

## **Rather hand it over?**

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

- [from $450**App Fix Ticket**One reproducible bug in an existing mobile or web app, diagnosed and fixed.**See scope and start**](https://app369.com/fixed-price/flutter-firebase-bug-fix/)
- [from $450**AI-Built App Rescue**A Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.****No issues worth fixing, no charge.**** If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.**See scope and start**](https://app369.com/fixed-price/ai-app-rescue/)

[**All 127 Fiverr reviews**](https://app369.com/reviews/)

Related: [**Firebase auth/credential-already-in-use**](https://app369.com/fix/firebase-auth-credential-already-in-use/) · [**Firebase auth/operation-not-allowed**](https://app369.com/fix/firebase-auth-operation-not-allowed/) · [**Firebase account-exists-with-different-credential**](https://app369.com/fix/firebase-auth-account-exists-with-different-credential/) · [**Firebase missing initial state**](https://app369.com/fix/firebase-auth-missing-initial-state/)

Questions

## **More on this error**

<details>

<summary>**Does the web popup flow need a nonce? **+</summary>

No. With signInWithPopup or signInWithRedirect and the apple.com provider, Firebase runs the flow and handles the nonce. The nonce is your job when you get the Apple ID token yourself.

</details>

<details>

<summary>**Can I reuse one nonce for every sign-in? **+</summary>

No. Generate a new random nonce for every sign-in request; reuse defeats the replay protection the nonce exists for.

</details>

<details>

<summary>**Can you fix it for me? **+</summary>

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.

</details>

A different error?

## **Describe it and get a written quote**

Send the error and what you were doing. You get a written scope, a fixed price and a timeline; Simon replies by email, usually within one business day.

[**Describe your problem **→](https://app369.com/contact/) [**All fixes**](https://app369.com/fix/)