Skip to content

Firebase Auth errorFirebase Auth: auth/second-factor-already-in-use

auth/second-factor-already-in-use is the Firebase Auth error for enrolling a second factor, such as a phone number, that is already enrolled on the account. It shows up when the app tries to enroll a factor that is already enrolled, for example when an enrollment screen runs again.

Short answer

Read multiFactor(user).enrolledFactors before showing the enrollment screen. If that phone number is already listed, show it as enrolled and skip enrollment. To replace a number, re-authenticate the user, unenroll the old factor, then enroll the new one.

Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.

Why the factor is already enrolled, and the fix

  1. 01

    The app enrolls without checking first

    “The second factor is already enrolled on this account.” Firebase, JS SDK auth errors (second-factor-already-in-use)

    An onboarding step that always runs enrollment fails for users who completed it earlier. Check enrolledFactors for the same phone number and only enroll when it is missing.

    import { multiFactor, PhoneMultiFactorInfo } from 'firebase/auth';
    
    const factors = multiFactor(auth.currentUser!).enrolledFactors;
    const alreadyEnrolled = factors.some(
      (f) => f.factorId === 'phone' && (f as PhoneMultiFactorInfo).phoneNumber === newPhoneNumber,
    );
  2. 02

    The user wants to change the phone number

    “To specify the factor to remove, pass a MultiFactorInfo object (retrieved from MultiFactorUser.enrolledFactors) or the factor's UID string.” Firebase, MultiFactorUser.unenroll()

    To replace a phone number, unenroll the old factor by its MultiFactorInfo or UID, then enroll the new number. Both steps need a recent sign-in, so re-authenticate the user first.

  3. 03

    The settings screen does not show existing factors

    “Returns a list of the user's enrolled second factors.” Firebase, MultiFactorUser.enrolledFactors

    Users enroll again when they can’t see that they already did. List the enrolled factors with their display names on the security screen.

  4. 04

    Too many factors

    “The maximum allowed number of second factors on a user has been exceeded.” Firebase, JS SDK auth errors (maximum-second-factor-count-exceeded)

    Also check: a different error, auth/maximum-second-factor-count-exceeded, means the user has reached the maximum number of second factors. Unenroll one before adding another.

Checked against the vendor’s docs on : Firebase JS SDK reference: MultiFactorUser; Firebase JS SDK source: auth errors; Firebase docs: Add multi-factor authentication to your web app.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

“Very responsive, attentive to fixing bugs, and completed the project as needed! Thank you!”
A buyer in the United States, July 2022. Shopify on Fiverr
All 127 Fiverr reviews

Related: Firebase auth/multi-factor-auth-required · Firebase auth/requires-recent-login · Firebase auth/web-storage-unsupported · Firebase credential-already-in-use

Questions

More on this error

Does unenrolling sign the user out?

Not by itself. Firebase’s reference notes that sessions are not revoked when a factor is unenrolled. Enrolling a new factor does revoke existing sessions (refresh tokens).

Does enrollment need a recent sign-in?

Yes. Firebase’s multi-factor guide starts enrollment by re-authenticating the user, and the MultiFactorUser reference requires a recent sign-in for both enroll() and unenroll().

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.

A different error?

Describe it and get a written quote

Send the error and what you were doing. You get a written scope, a fixed price and a timeline; Simon replies by email, usually within one business day.