Guide · Firebase

Firebase auth/unauthorized-domain after deploying

Updated 2 November 2026

This page applies to apps that use Firebase Authentication as their backend sign-in. The official fix is to edit the list of authorized domains from the Firebase console. If the domain is already listed, the sources say to check whether the API key used with Firebase Authentication is invalid.

Fixed in your code, then tested live. Check my app free

Why it happens

Firebase Authentication only allows OAuth operations from domains you have authorized for your project. The JavaScript SDK also uses your project's API key to verify that a sign-in redirect URL is valid according to that list, so a missing domain or a bad key stops sign-in.

Possible causes

The app domain is not authorized for OAuth operations for your Firebase project.
The redirect domain is not listed as an authorized domain for Firebase Authentication.
The API key used with the Firebase Authentication Service is invalid.
The Browser key for your project has been deleted in the Google Cloud console.
The Firebase Authentication API is not in the list of allowed APIs for the key.
If you self-host the sign-in code, the API key in your init file does not match the one in the Google Cloud console.
If you use Hosting-provided Auth helpers, the authDomain in your web app configuration does not use one of the domains for your Hosting site.

Official fix steps

Edit the list of authorized domains from the Firebase console. (firebase.google.com)
Make sure your redirect domain is in the list of authorized domains for your Firebase project. (firebase.google.com)
If the domain is already listed, continue to troubleshoot an invalid API key. (firebase.google.com)
If you use Hosting-provided Auth helpers, make sure the authDomain in your web app configuration is properly configured to use one of the domains for that Hosting site. (firebase.google.com)
Check in the APIs and Services Credentials panel of the Google Cloud console that the Browser key has not been deleted. (firebase.google.com)
If the key exists, make sure the Firebase Authentication API is in the list of allowed APIs for the key. (firebase.google.com)
If you self-host the sign-in code, make sure the API key in your init file matches the one in the Google Cloud console, correct it if necessary, then redeploy. (firebase.google.com)
If the Browser key was deleted, go to settings, Project settings, then Your apps, and click your web app. This automatically creates a new API key. (firebase.google.com)
After the new key is created, redeploy to Firebase if you use reserved Hosting URLs, or add the key to your init file and redeploy if you self-host. (firebase.google.com)

You can't see it yourself

You're signed in, your customers aren't. A domain that works for you while building does not tell you whether the domain your customers use is authorized. For example, Firebase adds localhost to the authorized domains by default in older projects, while projects created after April 28, 2025 no longer include it. So sign-in can work where you test and still fail on the deployed domain.

What to do next

App broke after you published it? Our AI agent fixes it in your code, then tests your live app again so you see the result yourself. The first check is free.

Fixed in your code, then tested live. Check my app free

Sources

VibeFix's AI agent signs up to your live app like a new person and shows whether sign-up and your pages work. It may not show Firebase sign-in on a deployed domain directly.

Last checked: 2 November 2026, against the sources listed above.

VibeFix is independent. Lovable, Bolt, Replit, Base44, v0 and Supabase are trademarks of their owners.

Want it fixed?

Our AI agent fixes it in your code and tests your live app again. See pricing.

It starts with a free check that confirms the problem on your live app, no account needed.

Check my app free

More guides