This page provides troubleshooting help and answers to frequently-asked
questions about using Firebase Authentication. If you
can't find what you're looking for or need additional help, contact
[Firebase support](https://support.google.com/firebase/contact/support).

#### Which regions are supported for phone
authentication?


Firebase Authentication supports phone number verification globally, but not all
networks reliably deliver verification messages. The following regions have
good rates of delivery, and should be expected to work well for
phone authentication. Where noted, some carriers are unavailable in a region
due to poor delivery success rates.

| **Region** | **Code** |
|---|---|
| AD | Andorra |
| AE | United Arab Emirates |
| AF | Afghanistan |
| AG | Antigua and Barbuda |
| AL | Albania |
| AM | Armenia |
| AO | Angola |
| AR | Argentina |
| AS | American Samoa |
| AT | Austria |
| AU | Australia |
| AW | Aruba |
| AZ | Azerbaijan |
| BA | Bosnia and Herzegovina |
| BB | Barbados |
| BD | Bangladesh |
| BE | Belgium |
| BF | Burkina Faso |
| BG | Bulgaria |
| BJ | Benin |
| BM | Bermuda |
| BN | Brunei Darussalam |
| BO | Bolivia |
| BR | Brazil |
| BS | Bahamas |
| BT | Bhutan |
| BW | Botswana |
| BY | Belarus |
| BZ | Belize |
| CA | Canada |
| CD | Congo, (Kinshasa) |
| CF | Central African Republic |
| CG | Congo (Brazzaville) |
| CH | Switzerland |
| CI | Côte d'Ivoire |
| CK | Cook Islands |
| CL | Chile |
| CM | Cameroon |
| CO | Colombia |
| CR | Costa Rica |
| CV | Cape Verde |
| CW | Curaçao |
| CY | Cyprus |
| CZ | Czech Republic |
| DE | Germany |
| DJ | Djibouti |
| DK | Denmark |
| DM | Dominica |
| DO | Dominican Republic |
| DZ | Algeria |
| EC | Ecuador |
| EG | Egypt |
| ES | Spain |
| ET | Ethiopia |
| FI | Finland |
| FJ | Fiji |
| FK | Falkland Islands (Malvinas) |
| FM | Micronesia, Federated States of |
| FO | Faroe Islands |
| FR | France |
| GA | Gabon |
| GB | United Kingdom |
| GD | Grenada |
| GE | Georgia |
| GF | French Guiana |
| GG | Guernsey |
| GH | Ghana |
| GI | Gibraltar |
| GL | Greenland |
| GM | Gambia |
| GP | Guadeloupe |
| GQ | Equatorial Guinea |
| GR | Greece |
| GT | Guatemala |
| GY | Guyana |
| HK | Hong Kong, SAR China |
| HN | Honduras |
| HR | Croatia |
| HT | Haiti |
| HU | Hungary |
| ID | Indonesia |
| IE | Ireland |
| IL | Israel |
| IM | Isle of Man |
| IN | India |
| IQ | Iraq |
| IT | Italy |
| JE | Jersey |
| JM | Jamaica |
| JO | Jordan |
| JP | Japan |
| KE | Kenya |
| KG | Kyrgyzstan |
| KH | Cambodia |
| KM | Comoros |
| KN | Saint Kitts and Nevis |
| KR | Korea (South) |
| KW | Kuwait |
| KY | Cayman Islands |
| KZ | Kazakhstan |
| LA | Lao PDR |
| LB | Lebanon |
| LC | Saint Lucia |
| LI | Liechtenstein |
| LK | Sri Lanka |
| LS | Lesotho |
| LT | Lithuania |
| LU | Luxembourg |
| LV | Latvia |
| LY | Libya |
| MA | Morocco |
| MD | Moldova |
| ME | Montenegro |
| MF | Saint-Martin (French part) |
| MG | Madagascar |
| MK | Macedonia, Republic of |
| MM | Myanmar |
| MN | Mongolia |
| MO | Macao, SAR China |
| MS | Montserrat |
| MT | Malta |
| MU | Mauritius |
| MW | Malawi |
| MX | Mexico |
| MY | Malaysia |
| MZ | Mozambique |
| NA | Namibia |
| NC | New Caledonia |
| NE | Niger |
| NF | Norfolk Island |
| NG | Nigeria |
| NI | Nicaragua |
| NL | Netherlands |
| NO | Norway |
| NP | Nepal |
| NZ | New Zealand |
| OM | Oman |
| PA | Panama |
| PE | Peru |
| PG | Papua New Guinea |
| PH | Philippines |
| PK | Pakistan |
| PL | Poland |
| PM | Saint Pierre and Miquelon |
| PR | Puerto Rico |
| PS | Palestinian Territory |
| PT | Portugal |
| PY | Paraguay |
| QA | Qatar |
| RE | Réunion |
| RO | Romania |
| RS | Serbia |
| RU | Russian Federation |
| RW | Rwanda |
| SA | Saudi Arabia |
| SC | Seychelles |
| SE | Sweden |
| SG | Singapore |
| SH | Saint Helena |
| SI | Slovenia |
| SK | Slovakia |
| SL | Sierra Leone |
| SN | Senegal |
| SR | Suriname |
| ST | Sao Tome and Principe |
| SV | El Salvador |
| SZ | Swaziland |
| TC | Turks and Caicos Islands |
| TG | Togo |
| TH | Thailand |
| TL | Timor-Leste |
| TM | Turkmenistan |
| TO | Tonga |
| TR | Turkey |
| TT | Trinidad and Tobago |
| TW | Taiwan, Republic of China |
| TZ | Tanzania, United Republic of |
| UA | Ukraine |
| UG | Uganda |
| US | United States of America |
| UY | Uruguay |
| UZ | Uzbekistan |
| VC | Saint Vincent and Grenadines |
| VE | Venezuela (Bolivarian Republic) |
| VG | British Virgin Islands |
| VI | Virgin Islands, US |
| VN | Viet Nam |
| WS | Samoa |
| YE | Yemen |
| YT | Mayotte |
| ZA | South Africa |
| ZM | Zambia |
| ZW | Zimbabwe |

#### What happened to the no-cost SMS on the
Spark pricing plan?


Starting September 2024, to improve the security and service quality of
Phone Authentication, Firebase projects must be linked to a
Cloud Billing account to enable and use the SMS Service.

<br />

#### How can I prevent SMS abuse when using
phone authentication?

<br />

To help protect your project from SMS traffic pumping and API abuse, take the
following steps:

##### Consider setting an SMS region policy

1. [View your regional SMS usage](https://cloud.google.com/identity-platform/pricing#viewing_usage).

   Look for regions with a very high number of sent SMS and a very low number
   (or zero) of verified SMS. The ratio of verified/sent is your success rate.
   Healthy success rates are commonly in the 70-85% range since SMS is not a
   guaranteed delivery protocol, and some regions may experience abuse. Success
   rates lower than 50% imply many sent SMS but few successful logins, which is
   a common indicator of bad actors and SMS traffic pumping.
2. Use
   [SMS Region Policy](https://console.firebase.google.com/project/_/authentication/settings)
   to either deny SMS regions with low success rates, or only allow certain
   regions if your app is only intended for distribution in certain markets.

##### Limit your authorized authentication domains

Use the
[Authentication settings dashboard](https://console.firebase.google.com/project/_/authentication/settings)
to manage authorized domains. The `localhost` domain is added by default to the
approved authentication domains to simplify development. Consider removing
`localhost` from the authorized domains in your **production** project to
prevent bad actors from running code on *their* `localhost` to access your
production project.

> [!IMPORTANT]
> **Important:** In projects created after April 28, 2025, Firebase Authentication no longer includes `localhost` as an authorized domain by default. Google strongly discourages the use of `localhost` in production projects. If you choose to authorize `localhost`, you can manually add it in the **Settings** tab, in **Authorized Domains** , by clicking **Add Domain**.

##### Enable and enforce App Check

Enable [App Check](https://firebase.google.com/docs/app-check.md.txt) to help protect your project from API
abuse by attesting that requests only come from applications associated with
your project.

To use App Check with Firebase Authentication, you must upgrade to
[Firebase Authentication with Identity Platform](https://firebase.google.com/docs/auth.md.txt#identity-platform).

Remember that you need to enforce App Check for Authentication in the
[Firebase console](https://console.firebase.google.com/project/_/appcheck/products)
(consider [monitoring traffic](https://firebase.google.com/docs/app-check/monitor-metrics.md.txt) before
enforcing). Also, double check your
[reCAPTCHA Enterprise](https://console.cloud.google.com/security/recaptcha)
approved sites list to validate that it only contains your production sites, and
that the list of applications registered to your project in App Check is
accurate.

Note that App Check helps protect against automated attacks by asserting
that the call comes from one of your registered applications. It does not
prevent users from using your app in unintended ways (for example, starting then
never finishing login flows to generate sent SMS).

<br />

<br />

<br />

#### Are phone numbers ported to a new carrier
supported by phone authentication?

<br />

At this time, numbers ported between carriers will result in all SMS becoming
undeliverable for those end users. There is no workaround, and Firebase is
working on this issue.

<br />

<br />

<br />

#### In my Android app, why am I getting the following
error:
`Google sign in failed`?

<br />

Follow the troubleshooting steps in this FAQ if you're getting the following
error:

```html
GoogleFragment: Google sign in failed
    com.google.android.gms.common.api.ApiException: 13: Unable to get token.
        at
com.google.android.gms.internal.auth-api.zbay.getSignInCredentialFromIntent(com.google.android.gms:play-services-auth@@20.3.0:6)
```

1. Make sure that **Google** sign-in is properly enabled as an authentication
   provider:

   1. In the Firebase console, open the
      [Authentication section](https://console.firebase.google.com/project/_/authentication/providers).

   2. Within the **Sign in method** tab, disable and then re-enable the
      **Google** sign-in method (even if it's already enabled):

      1. Open the **Google** sign-in method, disable it, and then click
         **Save**.

      2. Re-open the **Google** sign-in method, enable it, and then click
         **Save**.

2. Make sure that your app is using its up-to-date Firebase configuration file
   (`google-services.json`).  

   [Obtain your app's config file.](https://support.google.com/firebase/answer/7015592)

3. Check if you're still getting the error. If you are, continue to the next
   troubleshooting step.

4. Make sure the required underlying OAuth 2.0 clients are present.

   1. In the [**Credentials**](https://console.developers.google.com/apis/credentials?project=_)
      page of the Google Cloud console, look in the **OAuth 2.0 Client IDs**
      section.

   2. If OAuth 2.0 clients are ***not*** present (and you've done all the
      troubleshooting steps above), then
      [contact Support](https://firebase.google.com/support/troubleshooter/contact).

<br />

<br />

<br />

#### In my Apple platform app, why am I getting the
following error:
`You must specify <clientID> in <GIDConfiguration>`?

<br />

Follow the troubleshooting steps in this FAQ if you're getting the following
error:

```html
You must specify |clientID| in |GIDConfiguration|
```

1. Make sure that **Google** sign-in is properly enabled as an authentication
   provider:

   1. In the Firebase console, open the
      [Authentication section](https://console.firebase.google.com/project/_/authentication/providers).

   2. Within the **Sign in method** tab, disable and then re-enable the
      **Google** sign-in method (even if it's already enabled):

      1. Open the **Google** sign-in method, disable it, and then click
         **Save**.

      2. Re-open the **Google** sign-in method, enable it, and then click
         **Save**.

2. Make sure that your app is using its up-to-date Firebase configuration file
   (`GoogleService-Info.plist`).  

   [Obtain your app's config file.](https://support.google.com/firebase/answer/7015592)

3. Check if you're still getting the error. If you are, continue to the next
   troubleshooting step.

4. Make sure the required underlying OAuth 2.0 clients are present.

   1. In the [**Credentials**](https://console.developers.google.com/apis/credentials?project=_)
      page of the Google Cloud console, look in the **OAuth 2.0 Client IDs**
      section.

   2. If OAuth 2.0 clients are ***not*** present (and you've done all the
      troubleshooting steps above), then
      [contact Support](https://firebase.google.com/support/troubleshooter/contact).

<br />

<br />

<br />

#### In my web app, why am I getting the following
error:
`AuthErrorCode.INVALID_OAUTH_CLIENT_ID`?

<br />

Follow the troubleshooting steps in this FAQ if you're getting the following
error:

```html
AuthErrorCode.INVALID_OAUTH_CLIENT_ID
```

1. Make sure that **Google** sign-in is properly enabled as an authentication
   provider:

   1. In the Firebase console, open the
      [Authentication section](https://console.firebase.google.com/project/_/authentication/providers).

   2. Within the **Sign in method** tab, disable and then re-enable the
      **Google** sign-in method (even if it's already enabled):

      1. Open the **Google** sign-in method, disable it, and then click
         **Save**.

      2. Re-open the **Google** sign-in method, enable it, and then click
         **Save**.

2. Also, in the **Google** sign-in provider configuration of the **Authentication**
   section, make sure that the OAuth client ID and secret match the web client
   displayed in the
   [**Credentials**](https://console.developers.google.com/apis/credentials?project=_)
   page of the Google Cloud console (look in the **OAuth 2.0 Client IDs**
   section).

<br />

<br />

<br />

#### In my web app, why are sign-in with redirects
failing with the following error:
`This domain YOUR_REDIRECT_DOMAIN is not
authorized to run this operation`?

<br />

Follow the troubleshooting steps in this FAQ if you're getting the following
error:

```html
This domain YOUR_REDIRECT_DOMAIN is not authorized to run this operation.
```

> [!NOTE]
> **Note:** The hostname of the page where you saw this error is your current `authDomain`.

This error is most likely caused because your redirect domain isn't listed as an
authorized domain for Firebase Authentication, or the API key that you
use with the Firebase Authentication Service is invalid.

First make sure that <var translate="no">YOUR_REDIRECT_DOMAIN</var> is in the
[list of authorized domains](https://console.firebase.google.com/project/_/authentication/settings)
for your Firebase project. If your redirect domain is already listed there,
continue to troubleshoot an invalid API key.

By default, Firebase Authentication JS SDK relies on the API key for your Firebase
project that's labeled as the `Browser key`, and it uses this key to verify that
a sign-in redirect URL is valid according to the list of authorized domains.
Authentication gets this API key depending on how you access the Authentication SDK:

- If you use
  [Hosting-provided Auth helpers](https://firebase.google.com/docs/hosting/reserved-urls.md.txt#auth_helpers)
  to log users in with the Authentication JS SDK, then Firebase automatically
  obtains your API key with the rest of your Firebase configuration each time
  you deploy to Firebase Hosting. Make sure that the `authDomain` in your
  [web app `firebaseConfig`](https://firebase.google.com/docs/web/setup.md.txt#add-sdks-initialize) is
  [properly configured](https://firebase.google.com/docs/auth/web/redirect-best-practices.md.txt#update-authdomain)
  to use one of the domains for that Hosting site. You can verify this by
  going to
  `https://authDomain__/firebase/init.json`,
  and checking that the `projectId` matches that from your `firebaseConfig`.

- If you
  [self-host the sign-in code](https://firebase.google.com/docs/auth/web/redirect-best-practices.md.txt#self-host-helper-code),
  then you can use a `__/firebase/init.json` file to provide the Firebase
  configuration to the self-hosted Authentication JS SDK Redirect helper. The API
  key and the `projectId` listed in this config file should match your
  [web app `firebaseConfig`](https://firebase.google.com/docs/web/setup.md.txt#add-sdks-initialize).

Check to make sure this API key hasn't been deleted: Go to the
[*APIs \& Services \> Credentials*](https://console.cloud.google.com/apis/credentials?project=_)
panel in the Google Cloud console where all the API keys for your
project are listed.

- If the `Browser key` has *not* been deleted, check the following:

  - Make sure the Firebase Authentication API is in the list of allowed APIs for
    the key to access
    ([learn more about API restrictions for API keys](https://cloud.google.com/docs/authentication/api-keys#adding-api-restrictions)).

  - If you self-host the sign-in code, make sure the API key listed in your
    `__/firebase/init.json` file matches the API key in the
    Google Cloud console.
    Correct the key in the file, if necessary, then redeploy your app.

  - If the `Browser key` has been deleted, you can have Firebase generate a
    new API key for you: In the Firebase console, go to
    \> [*Project settings*](https://console.firebase.google.com/project/_/settings/general/),
    then in the **Your apps** section, click your web app. This action
    automatically creates an API key that you can see in the
    **SDK setup and configuration** section for your web app.

  Note that in the Google Cloud console this new API key won't be called
  `Browser key`; instead, it will be the same name as your Firebase Web App's
  nickname. If you decide to
  [add API restrictions](https://cloud.google.com/docs/authentication/api-keys#adding-api-restrictions)
  to this new API key, make sure the Firebase Authentication API is in the list of
  allowed APIs.

  Once your new API key is created, complete the applicable steps below:
  - If you use
    [reserved Hosting URLs](https://firebase.google.com/docs/hosting/reserved-urls.md.txt#sdk_auto-configuration),
    then redeploy your app to Firebase so that it can automatically obtain
    the new API key with the rest of your Firebase configuration.

  - If you
    [self-host the sign-in code](https://firebase.google.com/docs/auth/web/redirect-best-practices.md.txt#self-host-helper-code),
    copy the new API key and add it to your `__/firebase/init.json` file,
    then redeploy your app.

<br />

<br />

<br />

#### How do I manually construct an OAuth web client?

<br />

> [!NOTE]
> **Note:** Only in rare circumstances do you need to manually construct a web client.
>
>
> If you're manually constructing a web client to regenerate missing or
> invalid web clients, it's usually easier to just disable and then
> re-enable **Google** sign-in from within the **Authentication**
> section of the [Firebase console](https://console.firebase.google.com/).

1. Open the
   [**Credentials**](https://console.developers.google.com/apis/credentials?project=_)
   page of the Google Cloud console.

2. At the top of the page, select **Create credentials \> OAuth client ID**.

3. If you're prompted to configure your consent screen, follow the on-screen
   instructions, and then continue with the following steps of this FAQ.

4. Create the OAuth web client:

   1. For the **Application Type** , select **Web application**.

   2. For the **Authorized JavaScript Origins**, add the following:

      - `http://localhost`
      - `http://localhost:5000`
      - `https://PROJECT_ID.firebaseapp.com`
      - `https://PROJECT_ID.web.app`
   3. For the **Authorized Redirect URIs**, add the following:

      - `https://PROJECT_ID.firebaseapp.com/__/auth/handler`
      - `https://PROJECT_ID.web.app/__/auth/handler`
   4. Save the OAuth client.

   > [!NOTE]
   > **Note:** Some Firebase Hosting domains don't use Firebase project ID, so make sure the domains you enter match the domains provisioned for your Firebase project.

5. Copy the new OAuth client ID and client secret to your clipboard.

6. In the Firebase console, open the
   [Authentication section](https://console.firebase.google.com/project/_/authentication/providers).

7. Within the **Sign in method** tab, open the **Google sign-in** provider,
   and then paste the web server client ID and secret you just constructed and
   copied from the Google Cloud console. Click **Save**.

<br />

<br />

<br />

#### How is `%APP_NAME%` determined for the
email template for the confirmation email that can be sent to a user when
they sign up using an email address and password?

<br />

Before December 2022, the `%APP_NAME%` in the email template was populated with
the OAuth brand name that was automatically provisioned whenever an Android app
was registered in the Firebase project. Now, since the OAuth brand is
provisioned only when Google sign-in is enabled, the following describes how
`%APP_NAME%` is determined:

- If the OAuth brand name is available, then the `%APP_NAME%` in the email
  template will be the OAuth brand name (same as pre-December 2022 behavior).

- If the OAuth brand name is ***not*** available, here's how the `%APP_NAME%` in
  the email template is determined:

  - **For web apps** , the `%APP_NAME%` will be the
    [default Firebase Hosting site name](https://firebase.google.com/docs/projects/api/reference/rest/v1beta1/projects#DefaultResources.FIELDS.hosting_site)
    (the value preceding `.firebaseapp.com` and `.web.app` and usually the
    Firebase project ID).

  - **For mobile apps:**

    - If the Android package name or iOS bundle ID is present in the request,
      then the `%APP_NAME%` will be the app name used in the Play Store or
      App Store (respectively).

    - Otherwise, the `%APP_NAME%` will be the
      [default Firebase Hosting site name](https://firebase.google.com/docs/projects/api/reference/rest/v1beta1/projects#DefaultResources.FIELDS.hosting_site)
      (the value preceding `.firebaseapp.com` and `.web.app` and usually the
      Firebase project ID).

  Note that if the lookup of the default Firebase Hosting site name fails,
  then the final fallback is to use the Firebase project ID as the `%APP_NAME%`.

> [!NOTE]
> **Note:** SMS verification messages don't use OAuth brand name to populate `%APP_NAME%`, so they don't follow the logic described above.

<br />

<br />