Firebase: Error (auth/unauthorized-domain).

By Ohad Krispin, founder of VibeRaven · LinkedIn

"Firebase: Error (auth/unauthorized-domain)." means the host of the page that called signInWithPopup or signInWithRedirect is not in the Authorized domains list of your Firebase project, so the Firebase JS SDK refuses to start the OAuth flow. Add the host name, such as my-app.vercel.app or app.example.com, in the Firebase console under Authentication, Settings, Authorized domains, then sign in again. Vercel gives each branch its own URL and Firebase takes host names, not patterns, so add the branch URL you test on, or keep OAuth sign-in on a stable domain. Do not add vercel.app itself: the SDK treats every entry as covering its subdomains, so that would authorize every app on vercel.app. Checked against the Firebase JS SDK source and Firebase docs on 2026-10-27.

Use this from your agent

Claude Code: 4 read-only tools; cannot see your repo.

claude mcp add --transport http viberaven https://viberaven.dev/mcp

Codex: same server, in ~/.codex/config.toml.

[mcp_servers.viberaven]
url = "https://viberaven.dev/mcp"

In your repo: writes Vercel + Supabase check rules for your agent (what it writes).
```
npx -y viberaven init
```

Using Supabase Auth with Google instead of Firebase? See the Supabase callback Google needs.

Where the SDK raises it

Before a popup or redirect sign-in, the SDK fetches the project's authorized domains and compares each with the page's host. An entry that is an IP address must match exactly; any other entry matches that host and every subdomain of it. When nothing matches it fails with auth/unauthorized-domain. Production builds print only "Firebase: Error (auth/unauthorized-domain)."; with the debug error map the message reads "This domain is not authorized for OAuth operations for your Firebase project. Edit the list of authorized domains from the Firebase console."

Vercel preview URLs

Vercel's generated URLs include a branch URL that stays the same for every push to that branch, and a URL per commit. Add the branch URL you test sign-in on. Because the SDK accepts subdomains of an entry, previews served under a domain you own, such as feature-x.preview.example.com, are covered by one entry for preview.example.com.

localhost stopped working in a new project

Firebase says projects created after April 28, 2025 no longer include localhost as an authorized domain. Add it in the Settings tab of a development project if you need it, and keep it out of production.

This domain is not authorized to run this operation

That text appears on the auth handler page, not in your app. Firebase's troubleshooting docs say it means the redirect domain is missing from authorized domains or the API key in your config is invalid. Check the domain first, then the apiKey and authDomain your deployed build was given.

signInWithRedirect on a custom domain

Firebase's guide to signInWithRedirect describes sign-in failing when the app and authDomain are on different domains in browsers that block third-party storage. For apps not on Firebase Hosting it offers signInWithPopup, or proxying the auth requests to firebaseapp.com from your own domain.

Checklist

How to fix it, then check the fix

01Copy the host from the address bar of the page where sign-in failed: no https:// and no path.
02In the Firebase console open Authentication, then Settings, then Authorized domains, and add that host.
03For previews, add the branch URL you test on, or a domain you own that the previews are served under. Never add vercel.app.

Check which Firebase project the deployed build talks to:

grep -rn "authDomain" src app lib --include=*.ts --include=*.tsx --include=*.js

05Sign in on that host in a private window, then reload and confirm the user is still signed in.

Sources

Official docs behind this checklist

More Vercel errors

Browse all launch guides · Read resources · How to make and check your next change

FAQ

FAQ for builders before launch

Can I add a wildcard such as *.vercel.app?

The SDK compares host names and treats each entry as covering its subdomains, so an entry for vercel.app would allow every Vercel app, not only yours. Add specific hosts.

Does email and password sign-in need the domain too?

The check runs before popup and redirect sign-in, the OAuth flows. Email and password sign-in does not go through it.