• firebase.
• auth.
• Auth

Error Codes

auth/expired-action-code

Thrown if the action code has expired.

auth/invalid-action-code

Thrown if the action code is invalid. This can happen if the code is malformed or has already been used.

auth/user-disabled

Thrown if the user corresponding to the given action code has been disabled.

auth/user-not-found

Thrown if there is no user corresponding to the action code. This may have happened if the user was deleted between when the action code was issued and when this method was called.

Returns metadata about the code.

Error Codes

auth/expired-action-code

Thrown if the action code has expired.

auth/invalid-action-code

Thrown if the action code is invalid. This can happen if the code is malformed or has already been used.

auth/user-disabled

Thrown if the user corresponding to the given action code has been disabled.

auth/user-not-found

Thrown if there is no user corresponding to the action code. This may have happened if the user was deleted between when the action code was issued and when this method was called.

Error Codes

auth/expired-action-code

Thrown if the password reset code has expired.

auth/invalid-action-code

Thrown if the password reset code is invalid. This can happen if the code is malformed or has already been used.

auth/user-disabled

Thrown if the user corresponding to the given password reset code has been disabled.

auth/user-not-found

Thrown if there is no user corresponding to the password reset code. This may have happened if the user was deleted between when the code was issued and when this method was called.

auth/weak-password

Thrown if the new password is not strong enough.

On successful creation of the user account, this user will also be signed in to your application.

User account creation can fail if the account already exists or the password is invalid.

Note: The email address acts as a unique identifier for the user and enables an email-based password reset. This function will create a new user account and set the initial user password.

Error Codes

auth/email-already-in-use

Thrown if there already exists an account with the given email address.

auth/invalid-email

Thrown if the email address is not valid.

auth/operation-not-allowed

Thrown if email/password accounts are not enabled. Enable email/password accounts in the Firebase Console, under the Auth tab.

auth/weak-password

Thrown if the password is not strong enough.

example

firebase.auth().createUserWithEmailAndPassword(email, password)
    .catch(function(error) {
  // Handle Errors here.
  var errorCode = error.code;
  var errorMessage = error.message;
  if (errorCode == 'auth/weak-password') {
    alert('The password is too weak.');
  } else {
    alert(errorMessage);
  }
  console.log(error);
});

Error Codes

auth/invalid-email

Thrown if the email address is not valid.

If sign-in succeeded, returns the signed in user. If sign-in was unsuccessful, fails with an error. If no redirect operation was called, returns null.

Error Codes

auth/account-exists-with-different-credential

Thrown if there already exists an account with the email address asserted by the credential. Resolve this by calling firebase.auth.Auth.fetchSignInMethodsForEmail with the error.email and then asking the user to sign in using one of the returned providers. Once the user is signed in, the original credential retrieved from the error.credential can be linked to the user with firebase.User.linkWithCredential to prevent the user from signing in again to the original provider via popup or redirect. If you are using redirects for sign in, save the credential in session storage and then retrieve on redirect and repopulate the credential using for example firebase.auth.GoogleAuthProvider.credential depending on the credential provider id and complete the link.

auth/auth-domain-config-required

Thrown if authDomain configuration is not provided when calling firebase.initializeApp(). Check Firebase Console for instructions on determining and passing that field.

auth/credential-already-in-use

Thrown if the account corresponding to the credential already exists among your users, or is already linked to a Firebase User. For example, this error could be thrown if you are upgrading an anonymous user to a Google user by linking a Google credential to it and the Google credential used is already associated with an existing Firebase Google user. An error.email and error.credential (firebase.auth.AuthCredential) fields are also provided. You can recover from this error by signing in with that credential directly via firebase.auth.Auth.signInWithCredential.

auth/email-already-in-use

Thrown if the email corresponding to the credential already exists among your users. When thrown while linking a credential to an existing user, an error.email and error.credential (firebase.auth.AuthCredential) fields are also provided. You have to link the credential to the existing user with that email if you wish to continue signing in with that credential. To do so, call firebase.auth.Auth.fetchSignInMethodsForEmail, sign in to error.email via one of the providers returned and then firebase.User.linkWithCredential the original credential to that newly signed in user.

auth/operation-not-allowed

Thrown if the type of account corresponding to the credential is not enabled. Enable the account type in the Firebase Console, under the Auth tab.

auth/operation-not-supported-in-this-environment

Thrown if this operation is not supported in the environment your application is running on. "location.protocol" must be http or https.

auth/timeout

Thrown typically if the app domain is not authorized for OAuth operations for your Firebase project. Edit the list of authorized domains from the Firebase console.

This method does not work in a Node.js environment.

example

// First, we perform the signInWithRedirect.
// Creates the provider object.
var provider = new firebase.auth.FacebookAuthProvider();
// You can add additional scopes to the provider:
provider.addScope('email');
provider.addScope('user_friends');
// Sign in with redirect:
auth.signInWithRedirect(provider)
////////////////////////////////////////////////////////////
// The user is redirected to the provider's sign in flow...
////////////////////////////////////////////////////////////
// Then redirected back to the app, where we check the redirect result:
auth.getRedirectResult().then(function(result) {
  // The firebase.User instance:
  var user = result.user;
  // The Facebook firebase.auth.AuthCredential containing the Facebook
  // access token:
  var credential = result.credential;
  // As this API can be used for sign-in, linking and reauthentication,
  // check the operationType to determine what triggered this redirect
  // operation.
  var operationType = result.operationType;
}, function(error) {
  // The provider's account email, can be used in case of
  // auth/account-exists-with-different-credential to fetch the providers
  // linked to the email:
  var email = error.email;
  // The provider's credential:
  var credential = error.credential;
  // In case of auth/account-exists-with-different-credential error,
  // you can fetch the providers using this:
  if (error.code === 'auth/account-exists-with-different-credential') {
    auth.fetchSignInMethodsForEmail(email).then(function(providers) {
      // The returned 'providers' is a list of the available providers
      // linked to the email address. Please refer to the guide for a more
      // complete explanation on how to recover from this error.
    });
  }
});

Prior to 4.0.0, this triggered the observer when users were signed in, signed out, or when the user's ID token changed in situations such as token expiry or password change. After 4.0.0, the observer is only triggered on sign-in or sign-out.

To keep the old behavior, see firebase.auth.Auth.onIdTokenChanged.

example

firebase.auth().onAuthStateChanged(function(user) {
  if (user) {
    // User is signed in.
  }
});

example

firebase.auth().onIdTokenChanged(function(user) {
  if (user) {
    // User is signed in or token was refreshed.
  }
});

To complete the password reset, call firebase.auth.Auth.confirmPasswordReset with the code supplied in the email sent to the user, along with the new password specified by the user.

Error Codes

auth/invalid-email

Thrown if the email address is not valid.

auth/missing-android-pkg-name

An Android package name must be provided if the Android app is required to be installed.

auth/missing-continue-uri

A continue URL must be provided in the request.

auth/missing-ios-bundle-id

An iOS Bundle ID must be provided if an App Store ID is provided.

auth/invalid-continue-uri

The continue URL provided in the request is invalid.

auth/unauthorized-continue-uri

The domain of the continue URL is not whitelisted. Whitelist the domain in the Firebase console.

auth/user-not-found

Thrown if there is no user corresponding to the email address.

example

var actionCodeSettings = {
  url: 'https://www.example.com/?email=user@example.com',
  iOS: {
    bundleId: 'com.example.ios'
  },
  android: {
    packageName: 'com.example.android',
    installApp: true,
    minimumVersion: '12'
  },
  handleCodeInApp: true
};
firebase.auth().sendPasswordResetEmail(
    'user@example.com', actionCodeSettings)
    .then(function() {
      // Password reset email sent.
    })
    .catch(function(error) {
      // Error occurred. Inspect error.code.
    });

The sign-in operation has to always be completed in the app unlike other out of band email actions (password reset and email verifications). This is because, at the end of the flow, the user is expected to be signed in and their Auth state persisted within the app.

To complete sign in with the email link, call firebase.auth.Auth.signInWithEmailLink with the email address and the email link supplied in the email sent to the user.

Error Codes

auth/argument-error

Thrown if handleCodeInApp is false.

auth/invalid-email

Thrown if the email address is not valid.

auth/missing-android-pkg-name

An Android package name must be provided if the Android app is required to be installed.

auth/missing-continue-uri

A continue URL must be provided in the request.

auth/missing-ios-bundle-id

An iOS Bundle ID must be provided if an App Store ID is provided.

auth/invalid-continue-uri

The continue URL provided in the request is invalid.

auth/unauthorized-continue-uri

The domain of the continue URL is not whitelisted. Whitelist the domain in the Firebase console.

example

var actionCodeSettings = {
  // The URL to redirect to for sign-in completion. This is also the deep
  // link for mobile redirects. The domain (www.example.com) for this URL
  // must be whitelisted in the Firebase Console.
  url: 'https://www.example.com/finishSignUp?cartId=1234',
  iOS: {
    bundleId: 'com.example.ios'
  },
  android: {
    packageName: 'com.example.android',
    installApp: true,
    minimumVersion: '12'
  },
  // This must be true.
  handleCodeInApp: true
};
firebase.auth().sendSignInLinkToEmail('user@example.com', actionCodeSettings)
    .then(function() {
      // The link was successfully sent. Inform the user. Save the email
      // locally so you don't need to ask the user for it again if they open
      // the link on the same device.
    })
    .catch(function(error) {
      // Some error occurred, you can inspect the code: error.code
    });

This makes it easy for a user signing in to specify whether their session should be remembered or not. It also makes it easier to never persist the Auth state for applications that are shared by other users or have sensitive data.

The default for web browser apps and React Native apps is 'local' (provided the browser supports this mechanism) whereas it is 'none' for Node.js backend apps.

Error Codes (thrown synchronously)

auth/invalid-persistence-type

Thrown if the specified persistence type is invalid.

auth/unsupported-persistence-type

Thrown if the current environment does not support the specified persistence type.

example

firebase.auth().setPersistence(firebase.auth.Auth.Persistence.SESSION)
    .then(function() {
  // Existing and future Auth states are now persisted in the current
  // session only. Closing the window would clear any existing state even if
  // a user forgets to sign out.
});

deprecated

This method is deprecated. Use firebase.auth.Auth.signInWithCredential instead.

Error Codes

auth/account-exists-with-different-credential

Thrown if there already exists an account with the email address asserted by the credential. Resolve this by calling firebase.auth.Auth.fetchSignInMethodsForEmail and then asking the user to sign in using one of the returned providers. Once the user is signed in, the original credential can be linked to the user with firebase.User.linkWithCredential.

auth/invalid-credential

Thrown if the credential is malformed or has expired.

auth/operation-not-allowed

Thrown if the type of account corresponding to the credential is not enabled. Enable the account type in the Firebase Console, under the Auth tab.

auth/user-disabled

Thrown if the user corresponding to the given credential has been disabled.

auth/user-not-found

Thrown if signing in with a credential from firebase.auth.EmailAuthProvider.credential and there is no user corresponding to the given email.

auth/wrong-password

Thrown if signing in with a credential from firebase.auth.EmailAuthProvider.credential and the password is invalid for the given email, or if the account corresponding to the email does not have a password set.

auth/invalid-verification-code

Thrown if the credential is a firebase.auth.PhoneAuthProvider.credential and the verification code of the credential is not valid.

auth/invalid-verification-id

Thrown if the credential is a firebase.auth.PhoneAuthProvider.credential and the verification ID of the credential is not valid.

example

firebase.auth().signInAndRetrieveDataWithCredential(credential)
    .then(function(userCredential) {
      console.log(userCredential.additionalUserInfo.username);
    });

If there is already an anonymous user signed in, that user will be returned; otherwise, a new anonymous user identity will be created and returned.

Error Codes

auth/operation-not-allowed

Thrown if anonymous accounts are not enabled. Enable anonymous accounts in the Firebase Console, under the Auth tab.

example

firebase.auth().signInAnonymously().catch(function(error) {
  // Handle Errors here.
  var errorCode = error.code;
  var errorMessage = error.message;

  if (errorCode === 'auth/operation-not-allowed') {
    alert('You must enable Anonymous auth in the Firebase Console.');
  } else {
    console.error(error);
  }
});

Error Codes

auth/account-exists-with-different-credential

Thrown if there already exists an account with the email address asserted by the credential. Resolve this by calling firebase.auth.Auth.fetchSignInMethodsForEmail and then asking the user to sign in using one of the returned providers. Once the user is signed in, the original credential can be linked to the user with firebase.User.linkWithCredential.

auth/invalid-credential

Thrown if the credential is malformed or has expired.

auth/operation-not-allowed

Thrown if the type of account corresponding to the credential is not enabled. Enable the account type in the Firebase Console, under the Auth tab.

auth/user-disabled

Thrown if the user corresponding to the given credential has been disabled.

auth/user-not-found

Thrown if signing in with a credential from firebase.auth.EmailAuthProvider.credential and there is no user corresponding to the given email.

auth/wrong-password

Thrown if signing in with a credential from firebase.auth.EmailAuthProvider.credential and the password is invalid for the given email, or if the account corresponding to the email does not have a password set.

auth/invalid-verification-code

Thrown if the credential is a firebase.auth.PhoneAuthProvider.credential and the verification code of the credential is not valid.

auth/invalid-verification-id

Thrown if the credential is a firebase.auth.PhoneAuthProvider.credential and the verification ID of the credential is not valid.

example

firebase.auth().signInWithCredential(credential).catch(function(error) {
  // Handle Errors here.
  var errorCode = error.code;
  var errorMessage = error.message;
  // The email of the user's account used.
  var email = error.email;
  // The firebase.auth.AuthCredential type that was used.
  var credential = error.credential;
  if (errorCode === 'auth/account-exists-with-different-credential') {
    alert('Email already associated with another account.');
    // Handle account linking here, if using.
  } else {
    console.error(error);
  }
 });

Custom tokens are used to integrate Firebase Auth with existing auth systems, and must be generated by the auth backend.

Fails with an error if the token is invalid, expired, or not accepted by the Firebase Auth service.

Error Codes

auth/custom-token-mismatch

Thrown if the custom token is for a different Firebase App.

auth/invalid-custom-token

Thrown if the custom token format is incorrect.

example

firebase.auth().signInWithCustomToken(token).catch(function(error) {
  // Handle Errors here.
  var errorCode = error.code;
  var errorMessage = error.message;
  if (errorCode === 'auth/invalid-custom-token') {
    alert('The token you provided is not valid.');
  } else {
    console.error(error);
  }
});

Fails with an error if the email address and password do not match.

Note: The user's password is NOT the password used to access the user's email account. The email address serves as a unique identifier for the user, and the password is used to access the user's account in your Firebase project.

See also: firebase.auth.Auth.createUserWithEmailAndPassword.

Error Codes

auth/invalid-email

Thrown if the email address is not valid.

auth/user-disabled

Thrown if the user corresponding to the given email has been disabled.

auth/user-not-found

Thrown if there is no user corresponding to the given email.

auth/wrong-password

Thrown if the password is invalid for the given email, or the account corresponding to the email does not have a password set.

example

firebase.auth().signInWithEmailAndPassword(email, password)
    .catch(function(error) {
  // Handle Errors here.
  var errorCode = error.code;
  var errorMessage = error.message;
  if (errorCode === 'auth/wrong-password') {
    alert('Wrong password.');
  } else {
    alert(errorMessage);
  }
  console.log(error);
});

Fails with an error if the email address is invalid or OTP in email link expires.

Note: Confirm the link is a sign-in email link before calling this method firebase.auth.Auth.isSignInWithEmailLink.

Error Codes

auth/expired-action-code

Thrown if OTP in email link expires.

auth/invalid-email

Thrown if the email address is not valid.

auth/user-disabled

Thrown if the user corresponding to the given email has been disabled.

example

firebase.auth().signInWithEmailLink(email, emailLink)
    .catch(function(error) {
      // Some error occurred, you can inspect the code: error.code
      // Common errors could be invalid email and invalid or expired OTPs.
    });

For abuse prevention, this method also requires a firebase.auth.ApplicationVerifier. The Firebase Auth SDK includes a reCAPTCHA-based implementation, firebase.auth.RecaptchaVerifier.

Error Codes

auth/captcha-check-failed

Thrown if the reCAPTCHA response token was invalid, expired, or if this method was called from a non-whitelisted domain.

auth/invalid-phone-number

Thrown if the phone number has an invalid format.

auth/missing-phone-number

Thrown if the phone number is missing.

auth/quota-exceeded

Thrown if the SMS quota for the Firebase project has been exceeded.

auth/user-disabled

Thrown if the user corresponding to the given phone number has been disabled.

auth/operation-not-allowed

Thrown if you have not enabled the provider in the Firebase Console. Go to the Firebase Console for your project, in the Auth section and the Sign in Method tab and configure the provider.

example

// 'recaptcha-container' is the ID of an element in the DOM.
var applicationVerifier = new firebase.auth.RecaptchaVerifier(
    'recaptcha-container');
firebase.auth().signInWithPhoneNumber(phoneNumber, applicationVerifier)
    .then(function(confirmationResult) {
      var verificationCode = window.prompt('Please enter the verification ' +
          'code that was sent to your mobile device.');
      return confirmationResult.confirm(verificationCode);
    })
    .catch(function(error) {
      // Handle Errors here.
    });

If succeeds, returns the signed in user along with the provider's credential. If sign in was unsuccessful, returns an error object containing additional information about the error.

Error Codes

auth/account-exists-with-different-credential

Thrown if there already exists an account with the email address asserted by the credential. Resolve this by calling firebase.auth.Auth.fetchSignInMethodsForEmail with the error.email and then asking the user to sign in using one of the returned providers. Once the user is signed in, the original credential retrieved from the error.credential can be linked to the user with firebase.User.linkWithCredential to prevent the user from signing in again to the original provider via popup or redirect. If you are using redirects for sign in, save the credential in session storage and then retrieve on redirect and repopulate the credential using for example firebase.auth.GoogleAuthProvider.credential depending on the credential provider id and complete the link.

auth/auth-domain-config-required

Thrown if authDomain configuration is not provided when calling firebase.initializeApp(). Check Firebase Console for instructions on determining and passing that field.

auth/cancelled-popup-request

Thrown if successive popup operations are triggered. Only one popup request is allowed at one time. All the popups would fail with this error except for the last one.

auth/operation-not-allowed

Thrown if the type of account corresponding to the credential is not enabled. Enable the account type in the Firebase Console, under the Auth tab.

auth/operation-not-supported-in-this-environment

Thrown if this operation is not supported in the environment your application is running on. "location.protocol" must be http or https.

auth/popup-blocked

Thrown if the popup was blocked by the browser, typically when this operation is triggered outside of a click handler.

auth/popup-closed-by-user

Thrown if the popup window is closed by the user without completing the sign in to the provider.

auth/unauthorized-domain

Thrown if the app domain is not authorized for OAuth operations for your Firebase project. Edit the list of authorized domains from the Firebase console.

This method does not work in a Node.js environment.

example

// Creates the provider object.
var provider = new firebase.auth.FacebookAuthProvider();
// You can add additional scopes to the provider:
provider.addScope('email');
provider.addScope('user_friends');
// Sign in with popup:
auth.signInWithPopup(provider).then(function(result) {
  // The firebase.User instance:
  var user = result.user;
  // The Facebook firebase.auth.AuthCredential containing the Facebook
  // access token:
  var credential = result.credential;
}, function(error) {
  // The provider's account email, can be used in case of
  // auth/account-exists-with-different-credential to fetch the providers
  // linked to the email:
  var email = error.email;
  // The provider's credential:
  var credential = error.credential;
  // In case of auth/account-exists-with-different-credential error,
  // you can fetch the providers using this:
  if (error.code === 'auth/account-exists-with-different-credential') {
    auth.fetchSignInMethodsForEmail(email).then(function(providers) {
      // The returned 'providers' is a list of the available providers
      // linked to the email address. Please refer to the guide for a more
      // complete explanation on how to recover from this error.
    });
  }
});

Error Codes

auth/auth-domain-config-required

Thrown if authDomain configuration is not provided when calling firebase.initializeApp(). Check Firebase Console for instructions on determining and passing that field.

auth/operation-not-supported-in-this-environment

Thrown if this operation is not supported in the environment your application is running on. "location.protocol" must be http or https.

auth/unauthorized-domain

Thrown if the app domain is not authorized for OAuth operations for your Firebase project. Edit the list of authorized domains from the Firebase console.

This method does not work in a Node.js environment.

This will trigger firebase.auth.Auth.onAuthStateChanged and firebase.auth.Auth.onIdTokenChanged listeners like other sign in methods.

The operation fails with an error if the user to be updated belongs to a different Firebase project.

Error Codes

auth/invalid-user-token

Thrown if the user to be updated belongs to a diffent Firebase project.

auth/user-token-expired

Thrown if the token of the user to be updated is expired.

auth/null-user

Thrown if the user to be updated is null.

auth/tenant-id-mismatch

Thrown if the provided user's tenant ID does not match the underlying Auth instance's configured tenant ID

Returns the user's email address if valid.

Error Codes

auth/expired-action-code

Thrown if the password reset code has expired.

auth/invalid-action-code

Thrown if the password reset code is invalid. This can happen if the code is malformed or has already been used.

auth/user-disabled

Thrown if the user corresponding to the given password reset code has been disabled.

auth/user-not-found

Thrown if there is no user corresponding to the password reset code. This may have happened if the user was deleted between when the code was issued and when this method was called.