FREE TOOL

Firebase auth/unauthorized-domain checker: is your domain on the list?

Paste the address of the page where sign-in fails, the error text, and the Authorized domains list from your Firebase console. The page compares the host with the list using the rules in Firebase’s documentation, says what to add and where, and gives you a prompt for your AI builder. Where Firebase does not say, the page says “Not stated by Firebase” instead of guessing.

Runs in your browser. Nothing you type is sent to us or stored.

1. The page where sign-in fails

Use the live address you see when the error appears. Only the host is compared; the path is ignored.

2. The error text (optional)

This page only covers auth/unauthorized-domain. If the text holds a different auth/... code, the page says so.

3. Your Authorized domains list

Firebase console, your project, Security > Authentication > Settings tab, Authorized domains section. You can paste the table as it is; column headings are ignored.

4. Result

Fill in the boxes above to see the result.

The rules this page uses

Quoted from Firebase’s documentation (read 18 October 2026):

• “The domain (www.example.com) for this URL must be in the authorized domains list in the Firebase Console.” (Email link authentication)
• “Make sure your continue_uri is in the list of authorized domains.” (Redirect sign-in best practices)
• “In the Authorized domains section, click Add domain, and add your domain.” Path: “In the Firebase console, go to the Security > Authentication > Settings tab.”
• “In projects created after April 28, 2025, Firebase Authentication no longer includes localhost as an authorized domain by default.”
• “Note that localhost is not allowed as a hosted domain for the purposes of phone auth.” (Phone authentication)

Firebase’s reference page lists the code auth/unauthorized-domain among its auth error codes. The text this page was built from gives no further explanation of it.

Not stated by Firebase

The pages above do not say any of the following, so this page does not assume them and tells you to add the exact host instead: whether example.com and www.example.com count as the same domain; whether a listed domain covers its subdomains; whether wildcards work; how ports are treated; whether an entry written with https:// or a path counts; whether 127.0.0.1 counts as localhost; whether every Firebase Hosting domain is already on the list. Capital letters in a host are ignored when comparing, because browsers write host names in lower case; that is not a Firebase statement.

FAQ

Which domain has to be on the Authorized domains list?
Firebase’s email-link page says the domain of the URL you want to redirect back to must be in the authorized domains list in the Firebase Console. Its redirect page says to make sure your continue_uri is in the list of authorized domains.

Where do I add a domain in the Firebase console?
Firebase says: in the Firebase console, go to Security > Authentication > Settings tab. In the Authorized domains section, click Add domain, and add your domain.

Is localhost on the list by default?
Firebase says that in projects created after April 28, 2025, Firebase Authentication no longer includes localhost as an authorized domain by default, and that you can add it manually in the Settings tab, in Authorized Domains, by clicking Add Domain.

Does example.com on the list cover www.example.com or other subdomains?
Not stated by Firebase in the pages this tool was built from. The tool treats every host as its own entry and tells you to add the exact host.

Are my details sent to VibeFix?
No. The check runs in your browser with a script on this page. Nothing you type is sent or stored.

Then test it as a stranger

After you add the domain, open your live app in a private window and try to sign in as a new person.

VibeFix’s check covers that part: its AI agent signs up to your live app like a new person and shows whether sign-up and your pages work. It does not look inside your Firebase project or read your settings. VibeFix checks; it does not fix your app.

More: Sign-up or login broken after publishing.

This tool applies the rules on the Firebase pages linked above. It does not connect to your project and cannot see your real settings. Firebase may change its rules, so compare with the current docs. Last checked: 18 October 2026.

VibeFix is independent. Lovable, Bolt, Replit, Base44, v0 and Firebase are trademarks of their owners.