Firebase auth/unauthorized-domain after deploy

What it means in plain English

Sign-in works on your laptop and fails on the deployed site. Firebase's JavaScript error reference says auth/unauthorized-domain is thrown when the app domain is not authorized for OAuth operations, and that you edit the authorized domains in the Firebase console. The auth troubleshooting FAQ shows the message "This domain is not authorized to run this operation" and says the hostname in that message is the page's authDomain.

Likely causes

• The app is now on something.vercel.app, something.netlify.app, or a custom domain, and only localhost was authorized.
• The project was created after April 28, 2025. Firebase says those projects no longer include localhost as an authorized domain by default.
• authDomain in the Firebase config does not match a domain that is authorized for the project.

How to fix it, step by step

1. Read the hostname in the error. Firebase says that hostname is the redirect domain to check, and that it is likely missing from the authorized list or the API key is not the Browser key the SDK expects.
2. Add that domain in the Firebase console. The email-link guide says: Security, then Authentication, then the Settings tab, then Authorized domains, then Add domain.
3. For a project created after April 28, 2025, add localhost yourself if you still need local sign-in. Firebase says it is not included by default, and discourages leaving localhost on a production project.
4. Confirm authDomain in the web config is one of the domains that serve the site. The FAQ says the SDK uses it when it checks the sign-in URL.

How to check it worked

• Sign-in from the deployed origin completes.
• The console no longer reports auth/unauthorized-domain.

Sources

• https://firebase.google.com/docs/auth/faq-and-troubleshooting (opens in a new tab)
• https://firebase.google.com/docs/reference/js/v8/firebase.auth.Error (opens in a new tab)
• https://firebase.google.com/docs/auth/web/email-link-auth (opens in a new tab)