Firebase auth/operation-not-allowed

What it means in plain English

Firebase's Auth error reference says auth/operation-not-allowed is thrown if you have not enabled the provider in the Firebase console. It says to open the Firebase console for the project, go to the Auth section and the Sign in Method tab, and configure the provider.

For email and password, the password-auth guide states a more specific path: Security, then Authentication, then the Sign-in method tab, enable the Email/password provider, and click Save.

auth/unauthorized-domain is a different code. That one means the app domain is not authorized. See Firebase auth/unauthorized-domain after deploy.

Likely causes

• Email/password, Google, or another provider is used in the app and is still disabled in this Firebase project.
• The code calls the provider in production, and the Firebase project that the live keys point at never had that provider enabled.
• The live site's hostname is missing from authorized domains. That is auth/unauthorized-domain, not this code.

How to fix it, step by step

1. Read error.code. Stay on this page when it is auth/operation-not-allowed.
2. In the Firebase console, open Security, then Authentication, then the Sign-in method tab. Enable the provider the app calls. For email and password, enable Email/password and click Save.
3. The password-auth guide also says you can run firebase init auth to configure providers, then firebase deploy --only auth.
4. Retry the same sign-in. The Auth reference says this code is the disabled-provider case, so the matching provider has to be the one you enable.
5. If the code changes to auth/unauthorized-domain, add the live hostname. That fix is on the unauthorized-domain page.

How to check it worked

• createUserWithEmailAndPassword or signInWithEmailAndPassword (or the other provider you enabled) returns a user.
• The client no longer reports auth/operation-not-allowed.

Sources

• https://firebase.google.com/docs/reference/node/firebase.auth.Error (opens in a new tab)
• https://firebase.google.com/docs/auth/web/password-auth (opens in a new tab)