Short answer
Firebase refused the request because a request limit was exceeded. New accounts are limited per IP address, and SMS codes are limited per IP address and per phone number. During testing, use fictional phone numbers from the Firebase console and stop scripts that create accounts in a loop; for real users, wait and retry later.
Which limit you hit, and the fix
01
Too many sign-ups from one IP address
“100 accounts/hour for each IP address” Firebase, Authentication limits
Account creation is limited per IP address. A test script, a QA team on one office network, or a launch event where everyone signs up on the same Wi-Fi can reach it.
02
Too many SMS codes to one number
“To prevent abuse, Firebase enforces a limit on the number of SMS messages that can be sent to a single phone number within a period of time.” Firebase, Phone authentication on the web
Phone sign-in has its own limits, including a limit on codes sent to a single phone number. Testing with your own phone number again and again is an easy way to hit it.
03
The fix for testing: fictional numbers instead of real ones
“Test phone number authentication without consuming your usage quota.” Firebase, Phone authentication on the web
Add fictional phone numbers with fixed codes in the Firebase console and use them for development and App Review. Use numbers that don’t exist and codes that are hard to guess.
Checked against the vendor’s docs on : Firebase docs: Authentication limits; Firebase docs: Phone authentication on the web; Firebase docs: Admin Authentication API errors.
Rather hand it over?
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
- from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.See scope and start
Related: Firebase auth/invalid-credential · Firebase auth/unauthorized-domain · Firebase App Check blocking requests · Firebase auth/requires-recent-login