Firebase Auth errorFirebase: “The user account has been disabled by an administrator” (auth/user-disabled)

Why Firebase blocks the account, and the fix

1. 01

   The account was disabled

   “Whether or not the user is disabled. true for disabled; false for enabled.” Firebase, Manage users (disabled property)

   An admin disabled the user in the console, or your server set disabled: true. Re-enable it the same way. In Flutter the code is user-disabled, without the auth/ prefix.

   // server, Admin SDK
   await getAuth().updateUser(uid, { disabled: false });

2. 02

   Show the person what happened

   “The user account has been disabled by an administrator.” GitHub, firebase-js-sdk auth error messages

   The raw error reads like a crash. Catch it on the sign-in screen and say the account is off and who to contact.

   try {
     await signInWithEmailAndPassword(auth, email, password);
   } catch (e) {
     if (e.code === 'auth/user-disabled') {
       showMessage('This account is turned off. Contact support to restore it.');
     }
   }

3. 03

   The person is still signed in on another device

   “The user is disabled” Firebase, Manage user sessions (when refresh tokens expire)

   Disabling stops the refresh token, so the session ends when the current ID token runs out, within an hour. To block them sooner, verify tokens on your server with checkRevoked set; the Admin SDK then reports a disabled user.

   await getAuth().verifyIdToken(idToken, true); // checkRevoked

4. 04

   Data access does not check it

   Firestore and Realtime Database rules see the token, not the disabled flag, so a disabled user’s unexpired token still works there for up to an hour. If that matters, also block the user in your own data; Firebase’s session docs show a rules check on a revokeTime value for this.

Checked against the vendor’s docs on November 8, 2026: Firebase docs: Manage users (Admin SDK); Firebase docs: Manage user sessions; Firebase docs: Admin Authentication API errors; firebase-js-sdk: auth error messages.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

• from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
• from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start

Related: Firebase “ID token has expired” · Firebase auth/admin-restricted-operation · Firebase auth/invalid-credential · Firebase “FIS_AUTH_ERROR”