Skip to content
Get a quote

Firebase Auth errorFirebase “auth/operation-not-allowed”

Sign-up or sign-in fails straight away with auth/operation-not-allowed, often on a new project or right after you add a sign-in method to the app. Firebase uses this code when the sign-in provider you called is switched off. Here is where to switch it on, in Firebase’s words.

Short answer

The sign-in provider your code calls is disabled for this Firebase project. In the Firebase console, open Security, then Authentication, then the Sign-in method tab, and enable the provider: Email/Password, Email link, Phone, Anonymous or a social provider. For email link sign-in, Email/Password must be on as well.

Which provider is off, and the fix

  1. 01

    The provider is disabled in the Firebase console

    “The provided sign-in provider is disabled for your Firebase project.” Firebase, Admin Authentication API errors

    Each sign-in method is a separate switch on the Sign-in method tab. Enable the one your code calls and click Save. We also check that the app’s Firebase config points at the project where you enabled it, since staging and production are often separate projects.

  2. 02

    Email link sign-in needs two switches

    “Note that email/password sign-in must be enabled to use email link sign-in.” Firebase, Authenticate with Firebase using email link

    Passwordless email link sign-in is its own provider, and it only works when Email/Password is enabled too. Turning on one without the other still fails.

  3. 03

    Phone or anonymous sign-in was never enabled

    “To sign in users by SMS, you must first enable the Phone Number sign-in method for your Firebase project” Firebase, Phone authentication on the web

    Phone and Anonymous are separate providers on the same tab. Code that calls signInWithPhoneNumber or signInAnonymously fails until each is switched on.

Checked against the vendor’s docs on : Firebase docs: Admin Authentication API errors; Firebase docs: Password authentication on the web; Firebase docs: Email link authentication on the web; Firebase docs: Phone authentication on the web; Firebase docs: Anonymous authentication on the web.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Related: Firebase auth/unauthorized-domain · Supabase OAuth provider disabled · Firebase auth/invalid-credential · Firebase auth/requires-recent-login

Questions

More on this error

Can I enable providers from the command line?

Yes. Firebase’s password guide says to run firebase init auth to configure authentication providers, and then firebase deploy --only auth.

Phone sign-in is enabled. Do I need anything else?

Firebase also asks you to set an SMS region policy on the same setup step, and says that for new projects, the default policy allows no regions. Check it before testing with real numbers.

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.

A different error?

Describe it and get a written quote

Send the error and what you were doing. You get a written scope, a fixed price and a timeline; we reply by email, usually within one business day.

Describe your problem All fixes