Firebase auth/invalid-credential

What it means in plain English

signInWithEmailAndPassword signs in with an email and a password. Firebase's JavaScript reference says it fails with an error if the email address and password do not match. When Email Enumeration Protection is enabled, that method fails with auth/invalid-credential for an invalid email/password.

The password is not the password for the email inbox. The email address is the unique identifier for the user, and the password is what accesses that user's account in this Firebase project.

The same reference's error-code map uses the string auth/invalid-credential for both INVALID_LOGIN_CREDENTIALS and INVALID_IDP_RESPONSE. It uses auth/wrong-password for INVALID_PASSWORD, and auth/unauthorized-domain for INVALID_ORIGIN.

The method is not supported on Auth instances created with a FirebaseServerApp.

Likely causes

• Email Enumeration Protection is enabled, and the email/password pair is invalid. That is the case the reference names for this code on signInWithEmailAndPassword.
• The password typed in is the mailbox password. The reference says that is not the Firebase project password.
• The same code string is also the map entry for INVALID_IDP_RESPONSE. The reference does not describe that case beyond the constant name.

How to fix it, step by step

1. Read the code and the method. Stay on this page when signInWithEmailAndPassword returns auth/invalid-credential and Email Enumeration Protection is enabled.
2. Sign in with the email and the password stored for that user in this Firebase project. The reference says those have to match.
3. If the account does not exist yet, createUserWithEmailAndPassword creates it and signs the user in. The reference says creation can fail if the account already exists or the password is invalid.
4. auth/wrong-password and auth/unauthorized-domain are different strings on the same map. The unauthorized-domain fix is Firebase auth/unauthorized-domain after deploy.
5. auth/operation-not-allowed is also a different string. On this reference, that code is what the email-update call throws when Email Enumeration Protection is enabled. See Firebase auth/operation-not-allowed.

How to check it worked

• signInWithEmailAndPassword returns a user credential for that email and password.
• The client no longer reports auth/invalid-credential for that call.

Sources

• https://firebase.google.com/docs/reference/js/auth (opens in a new tab)