Skip to content

Firebase Auth errorFirebase “auth/too-many-requests”

Sign-in, sign-up or a phone verification code suddenly fails with auth/too-many-requests, often during testing or on launch day. This code means a request limit was exceeded, and the limits Firebase lists are per IP address and per phone number. Here are the limits in Firebase’s words, and how to stay under them.

Short answer

Firebase refused the request because a request limit was exceeded. New accounts are limited per IP address, and SMS codes are limited per IP address and per phone number. During testing, use fictional phone numbers from the Firebase console and stop scripts that create accounts in a loop; for real users, wait and retry later.

Which limit you hit, and the fix

  1. 01

    Too many sign-ups from one IP address

    “100 accounts/hour for each IP address” Firebase, Authentication limits

    Account creation is limited per IP address. A test script, a QA team on one office network, or a launch event where everyone signs up on the same Wi-Fi can reach it.

  2. 02

    Too many SMS codes to one number

    “To prevent abuse, Firebase enforces a limit on the number of SMS messages that can be sent to a single phone number within a period of time.” Firebase, Phone authentication on the web

    Phone sign-in has its own limits, including a limit on codes sent to a single phone number. Testing with your own phone number again and again is an easy way to hit it.

  3. 03

    The fix for testing: fictional numbers instead of real ones

    “Test phone number authentication without consuming your usage quota.” Firebase, Phone authentication on the web

    Add fictional phone numbers with fixed codes in the Firebase console and use them for development and App Review. Use numbers that don’t exist and codes that are hard to guess.

Checked against the vendor’s docs on : Firebase docs: Authentication limits; Firebase docs: Phone authentication on the web; Firebase docs: Admin Authentication API errors.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Related: Firebase auth/invalid-credential · Firebase auth/unauthorized-domain · Firebase App Check blocking requests · Firebase auth/requires-recent-login

Questions

More on this error

How long until it works again?

Firebase’s phone guide says that if you hit the limit during development, use a different phone number for testing or try the request again later. Firebase doesn’t publish the per-number window.

Can App Review get locked out too?

It can be at risk. Firebase says fictional numbers minimize the risk of rejection during App Store review if the reviewer happens to use the same phone number. Give App Review a fictional test number and code from the Firebase console.

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.

A different error?

Describe it and get a written quote

Send the error and what you were doing. You get a written scope, a fixed price and a timeline; we reply by email, usually within one business day.