Firebase Google sign-in not working: enable the provider, then check domains

Short answer: Google sign-in fails when the Google provider is not enabled in Firebase Authentication, or when the domain your app redirects from is not in the Authorized Domains list. Enable the provider under Security > Authentication > Sign-in method, then add your domain in the Settings tab under Authorized Domains.

This guide applies to apps made with AI app builders such as Lovable, Bolt, Base44, Replit or v0 when the app uses Firebase Authentication for Google sign-in. The settings below are in the Firebase console and the Google Cloud console.

Why it happens

Firebase Authentication needs the Google provider turned on for your project before Google sign-in can work.

When your app uses a redirect, Firebase uses your list of authorized domains to check that the sign-in redirect URL is valid. If the domain is not on that list, the sign-in with redirects fails with This domain YOUR_REDIRECT_DOMAIN is not authorized to run this operation. The hostname of the page where you see this error is your current authDomain.

On project creation, Firebase provisions a unique subdomain for your project, https://my-app-12345.firebaseapp.com, and this is also used as the redirect mechanism for OAuth sign-in. That domain needs to be allowed for all supported OAuth providers.

If you use a custom domain, you set it with the authDomain field when you initialize the JavaScript library, and you whitelist the redirect page URL, https://auth.custom.domain.com/__/auth/handler, in the Google developer console or OAuth setup page.

A web app can also fail with AuthErrorCode.INVALID_OAUTH_CLIENT_ID. Check that the OAuth client ID and secret in the Google sign-in provider configuration match the web client shown in the Credentials page of the Google Cloud console.

How to fix it

1. In the Firebase console, go to Security > Authentication.
2. In the Sign-in method tab, enable the Google sign-in provider.
3. Click Save.
4. Optional: if you prefer the Firebase CLI, run firebase init auth to configure authentication providers, and then run firebase deploy --only auth to deploy the changes to your project.
5. If Google sign-in was already enabled, open the Google sign-in method, disable it, and then click Save. Re-open the Google sign-in method, enable it, and then click Save.
6. In the Authentication section, open the Google sign-in provider configuration and make sure the OAuth client ID and secret match the web client displayed in the Credentials page of the Google Cloud console, in the OAuth 2.0 Client IDs section.
7. Open the Settings tab, go to Authorized Domains, and make sure your redirect domain is in the list. If it is missing, click Add Domain and add it.
8. If you use a custom domain, add it to the list of authorized domains in the Firebase console, for example auth.custom.domain.com.
9. In the Google developer console or OAuth setup page, whitelist the URL of the redirect page on your custom domain: https://auth.custom.domain.com/__/auth/handler.
10. When you initialize the JavaScript library, set the authDomain field to your custom domain instead of PROJECT_ID.firebaseapp.com.
11. If you see This domain YOUR_REDIRECT_DOMAIN is not authorized to run this operation and your domain is already listed, check the API key. Go to APIs & Services > Credentials in the Google Cloud console and make sure the Browser key has not been deleted.
12. Make sure the Firebase Authentication API is in the list of allowed APIs for the key to access.
13. If you self-host the sign-in code, make sure the API key listed in your __/firebase/init.json file matches the API key in the Google Cloud console. Correct the key in the file, if necessary, then redeploy your app.
14. If the Browser key has been deleted, in the Firebase console go to settings > Project settings, then in the Your apps section click your web app. This action automatically creates an API key that you can see in the SDK setup and configuration section for your web app.
15. If you use reserved Hosting URLs, redeploy your app to Firebase so that it can automatically obtain the new API key with the rest of your Firebase configuration.
16. If you self-host the sign-in code, copy the new API key and add it to your __/firebase/init.json file, then redeploy your app.

How to check it on your live app

Open your live app in a private window and click the Google sign-in button. Complete the Google sign-in flow and see whether you land back in your app signed in.

If you still see This domain YOUR_REDIRECT_DOMAIN is not authorized to run this operation, the hostname in the error is your current authDomain. Compare it with the Authorized Domains list.

Prompt to paste into your AI builder

Paste this into your AI builder: "My Firebase Google sign-in is not working. Please show me the change first before applying it. Check that the authDomain in my Firebase config matches a domain in the Authorized Domains list in the Firebase console (Security > Authentication > Settings tab). If I use a custom domain, set authDomain to that custom domain and tell me to whitelist https://auth.custom.domain.com/__/auth/handler in the Google developer console. Also tell me what to check by hand: that the Google sign-in provider is enabled under Security > Authentication > Sign-in method, and that the OAuth client ID and secret in the Google sign-in provider configuration match the web client in the Credentials page of the Google Cloud console. Show me the exact lines you would change and wait for my OK."

FAQ

Why do I see This domain YOUR_REDIRECT_DOMAIN is not authorized to run this operation? Your redirect domain is not listed as an authorized domain for Firebase Authentication, or the API key you use with the Firebase Authentication Service is invalid. The hostname of the page where you saw this error is your current authDomain.

What does AuthErrorCode.INVALID_OAUTH_CLIENT_ID mean on my web app? Check that the OAuth client ID and secret in the Google sign-in provider configuration match the web client displayed in the Credentials page of the Google Cloud console, in the OAuth 2.0 Client IDs section.

Which domain does Firebase use for OAuth sign-in by default? On project creation, Firebase provisions a unique subdomain for your project, https://my-app-12345.firebaseapp.com, and this is also used as the redirect mechanism for OAuth sign-in.

How do I use a custom domain for Google sign-in? Set up a custom domain with Firebase Hosting, add your custom domain to the list of authorized domains in the Firebase console, whitelist https://auth.custom.domain.com/__/auth/handler in the Google developer console or OAuth setup page, and set the authDomain field to your custom domain when you initialize the JavaScript library.

What if the Browser key was deleted? In the Firebase console, go to settings > Project settings, then in the Your apps section click your web app. This action automatically creates an API key that you can see in the SDK setup and configuration section for your web app.

Related guides

• Google sign-in fails on your custom domain: redirect_uri_mismatch — when the redirect URL itself is the problem on a custom domain.
• "Sign in with Google" fails for new people on my live app: why, and the fix — the same symptom seen from your live users' side.
• Sign-up or login broken after publishing (Supabase redirect URLs) — if your app uses Supabase instead of Firebase, the redirect list lives elsewhere.

Sources

• Authenticate Using Google with JavaScript | Firebase Authentication
• Authentication FAQ and troubleshooting | Firebase Authentication

VibeFix's check can show this on your live app: its AI agent signs up to your app like a new person, uses it on a phone and a computer, and shows what breaks. VibeFix checks; it does not fix your app.

Last checked: 19 October 2026, against the sources listed above.

VibeFix is independent. Lovable, Bolt, Replit, Base44, v0 and Supabase are trademarks of their owners.