Skip to content
Get a quote

Firebase phone sign-in errorFirebase phone sign-in: “auth/invalid-app-credential”

People enter their phone number, tap send, and no code arrives: Firebase returns auth/invalid-app-credential. Before sending an SMS, Firebase checks that the request comes from your real app, using reCAPTCHA on the web, Play Integrity on Android and a silent push or reCAPTCHA on iOS. That check failed. Here’s what each platform needs, in Firebase’s words, or hand it over at a fixed price.

Short answer

Firebase couldn’t verify that the request came from your app. On the web, add your live domain to Authorized domains and render the reCAPTCHA verifier before calling signInWithPhoneNumber. On Android, add the app’s SHA-256 fingerprints, including the Play App Signing one, in the Firebase console. On iOS, upload an APNs key and add the URL scheme so the reCAPTCHA fallback works.

What failed, by platform

  1. 01

    Web: the domain isn’t authorized

    “Note that localhost is not allowed as a hosted domain for the purposes of phone auth.” Firebase, Authenticate with Firebase with a phone number (web)

    Phone sign-in only runs on domains listed in Firebase Authentication’s settings. Add the production domain and any custom domain the app is served from. Firebase’s docs say localhost isn’t allowed as a hosted domain for phone auth, so test on a deployed domain.

  2. 02

    Web: the reCAPTCHA token is missing or stale

    “Thrown if the reCAPTCHA response token was invalid, expired, or if this method was called from a non-whitelisted domain.” Firebase, firebase.auth.Auth

    Create the RecaptchaVerifier once, after the button or container exists, and reuse it. A verifier created twice, or a token reused after a failed attempt, fails the check. Reset it before retrying. Firebase documents the related captcha-check-failed code like this:

  3. 03

    Android: the SHA-256 fingerprint is missing

    “To use Play Integrity, specify your app's SHA-256 fingerprint if you haven't already.” Firebase, Authenticate with Firebase on Android using a phone number

    Play Integrity needs the app’s SHA-256 fingerprints registered. Add the SHA-256 from your debug key, your upload key and the Play App Signing key (Play Console, App integrity), since store builds are signed with Google’s key, then download a fresh google-services.json.

  4. 04

    iOS: no APNs key, or the reCAPTCHA fallback is blocked

    “This reCAPTCHA flow requires your API Key to be unrestricted or allowlisted for "${PROJECT_NAME}.firebaseapp.com".” Firebase, Authenticate with Firebase on Apple platforms using a phone number

    Upload an APNs authentication key to Firebase and add the Encoded App ID as a URL scheme in Xcode. When the silent push can’t arrive, as on the simulator, Firebase falls back to reCAPTCHA, which also fails if the API key’s restrictions don’t allow it.

Checked against the vendor’s docs on : Firebase docs: Phone authentication (web); Firebase docs: Phone authentication (Android); Firebase docs: Phone authentication (Apple platforms); Firebase reference: firebase.auth.Auth.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Related: Firebase App Check blocking requests · Firebase auth/too-many-requests · Firebase Google sign-in DEVELOPER_ERROR on Android · Firebase auth/invalid-credential

Questions

More on this error

Can I test phone sign-in without real SMS?

Yes. Firebase lets you add fictional phone numbers and codes in the console, which skip sending an SMS. Keep them out of the production app.

Why does it work in debug but not from the Play Store?

Store installs are signed with the Play App Signing key, not your upload or debug key. Add that key’s SHA-256 fingerprint in the Firebase console.

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.

A different error?

Describe it and get a written quote

Send the error and what you were doing. You get a written scope, a fixed price and a timeline; we reply by email, usually within one business day.

Describe your problem All fixes