Firebase FAQ

The page is a collection of FAQs and troubleshooting help for Firebase in general, as well as for specific products.

Do you have other challenges or can't find your issue described on this page?



Platforms and frameworks

Visit the platform-specific troubleshooting & FAQ pages for helpful tips and answers for more FAQ.



Firebase projects and Firebase apps

Permissions and access to Firebase projects

API keys for Firebase

Are Firebase API keys secret? Can they be included in my code or configuration files?
Here are the most important things to learn about API keys for Firebase services:

If your app's setup follows the above guidelines, then API keys restricted to Firebase services do not need to be treated as secrets, and it's safe to include them in your code or configuration files.

I received an email from Google Cloud about a "publicly accessible Google API key for your Google Cloud project". What do I need to do?

If you've received an email from Google Cloud about a "publicly accessible Google API key for your Google Cloud project" and the API key listed in the email is your Firebase API key, then make sure that the API key meets the following requirements to be safe to include in your code or configuration files. You can verify the following in the APIs & Services > Credentials page of the Google Cloud console.

Also, make sure that you're using Firebase Security Rules and App Check as recommended for the Firebase products that you use.

You can learn details about API keys for Firebase and find a list of FAQs in Learn about using and managing API keys for Firebase



Firebase console

How does the console's "sample app experience" work? What happens and what can I do?

The Firebase console provides a sample app experience so that you have a real working app to explore and experiment with Firebase and other Google services (like the Gemini API).

Automatic Firebase setup and deployment of the sample app

When you go through the sample app experience in the Firebase console, we automatically do the following for you:

Explore the sample app's codebase



Firebase Local Emulator Suite



Pricing

For pricing FAQs specific to a product, see the product's section on this page or within its dedicated product documentation.

Does Firebase offer no-cost trial credits for paid products?

Firebase paid services can be used under the Google Cloud Free Trial. New Google Cloud and Firebase users can take advantage of a 90-day trial period that includes $300 in free Cloud Billing credits to explore and evaluate Google Cloud and Firebase products and services.

During the Google Cloud Free Trial period, you'll be provided a Free Trial Cloud Billing account. Any Firebase project that's linked to that billing account will be on the pay-as-you-go Blaze pricing plan during the Free Trial period.

Don't worry, linking a Firebase project to this Free Trial Cloud Billing account does not enable us to charge you for usage beyond these credits. You are not charged for usage beyond these credits unless you explicitly enable billing by upgrading your Free Trial Cloud Billing account to a paid account. You can upgrade to a paid account at any time during the trial. After you've upgraded to a paid account, you can still use any remaining credits (within the 90-day period).

Once the free trial expires and if you have not upgraded the Free Trial Cloud Billing account to a paid account, then your linked Firebase project is automatically downgraded to the Spark pricing plan. Note that you can upgrade to the Blaze pricing plan again at any time.

Learn more about the Google Cloud Free Trial.



Privacy



A/B Testing

Visit the A/B Testing troubleshooting & FAQ page for helpful tips and answers to more FAQs.



AdMob



Analytics



Authentication

Authentication: How can I prevent SMS abuse when using phone authentication?

To help protect your project from SMS traffic pumping and API abuse, take the following steps:

Consider setting an SMS region policy
  1. View your regional SMS usage.

    Look for regions with a very high number of sent SMS and a very low number (or zero) of verified SMS. The ratio of verified/sent is your success rate. Healthy success rates are commonly in the 70-85% range since SMS is not a guaranteed delivery protocol, and some regions may experience abuse. Success rates lower than 50% imply many sent SMS but few successful logins, which is a common indicator of bad actors and SMS traffic pumping.

  2. Use SMS Region Policy to either deny SMS regions with low success rates, or only allow certain regions if your app is only intended for distribution in certain markets.

Limit your authorized authentication domains

Use the Authentication settings dashboard to manage authorized domains. The localhost domain is added by default to the approved authentication domains to simplify development. Consider removing localhost from the authorized domains in your production project to prevent bad actors from running code on their localhost to access your production project.

Enable and enforce App Check

Enable App Check to help protect your project from API abuse by attesting that requests only come from applications associated with your project.

To use App Check with Firebase Authentication, you must upgrade to Firebase Authentication with Identity Platform.

Remember that you need to enforce App Check for Authentication in the Firebase console (consider monitoring traffic before enforcing). Also, double check your reCAPTCHA Enterprise approved sites list to validate that it only contains your production sites, and that the list of applications registered to your project in App Check is accurate.

Note that App Check helps protect against automated attacks by asserting that the call comes from one of your registered applications. It does not prevent users from using your app in unintended ways (for example, starting then never finishing login flows to generate sent SMS).

Authentication: Are phone numbers ported to a new carrier supported by phone authentication?

At this time, numbers ported between carriers will result in all SMS becoming undeliverable for those end users. There is no workaround, and Firebase is working on this issue.

Authentication: In my Android app, why am I getting the following error:
Google sign in failed?

Follow the troubleshooting steps in this FAQ if you're getting the following error:

GoogleFragment: Google sign in failed
    com.google.android.gms.common.api.ApiException: 13: Unable to get token.
        at
com.google.android.gms.internal.auth-api.zbay.getSignInCredentialFromIntent(com.google.android.gms:play-services-auth@@20.3.0:6)
  1. Make sure that Google sign-in is properly enabled as an authentication provider:

    1. In the Firebase console, open the Authentication section.

    2. Within the Sign in method tab, disable and then re-enable the Google sign-in method (even if it's already enabled):

      1. Open the Google sign-in method, disable it, and then click Save.

      2. Re-open the Google sign-in method, enable it, and then click Save.

  2. Make sure that your app is using its up-to-date Firebase configuration file (google-services.json).
    Obtain your app's config file.

  3. Check if you're still getting the error. If you are, continue to the next troubleshooting step.

  4. Make sure the required underlying OAuth 2.0 clients are present.

    1. In the Credentials page of the Google Cloud console, look in the OAuth 2.0 Client IDs section.

    2. If OAuth 2.0 clients are not present (and you've done all the troubleshooting steps above), then contact Support.

Authentication: In my Apple platform app, why am I getting the following error:
You must specify <clientID> in <GIDConfiguration>?

Follow the troubleshooting steps in this FAQ if you're getting the following error:

You must specify |clientID| in |GIDConfiguration|
  1. Make sure that Google sign-in is properly enabled as an authentication provider:

    1. In the Firebase console, open the Authentication section.

    2. Within the Sign in method tab, disable and then re-enable the Google sign-in method (even if it's already enabled):

      1. Open the Google sign-in method, disable it, and then click Save.

      2. Re-open the Google sign-in method, enable it, and then click Save.

  2. Make sure that your app is using its up-to-date Firebase configuration file (GoogleService-Info.plist).
    Obtain your app's config file.

  3. Check if you're still getting the error. If you are, continue to the next troubleshooting step.

  4. Make sure the required underlying OAuth 2.0 clients are present.

    1. In the Credentials page of the Google Cloud console, look in the OAuth 2.0 Client IDs section.

    2. If OAuth 2.0 clients are not present (and you've done all the troubleshooting steps above), then contact Support.

Authentication: In my web app, why am I getting the following error:
AuthErrorCode.INVALID_OAUTH_CLIENT_ID?

Follow the troubleshooting steps in this FAQ if you're getting the following error:

AuthErrorCode.INVALID_OAUTH_CLIENT_ID
  1. Make sure that Google sign-in is properly enabled as an authentication provider:

    1. In the Firebase console, open the Authentication section.

    2. Within the Sign in method tab, disable and then re-enable the Google sign-in method (even if it's already enabled):

      1. Open the Google sign-in method, disable it, and then click Save.

      2. Re-open the Google sign-in method, enable it, and then click Save.

  2. Also, in the Google sign-in provider configuration of the Authentication section, make sure that the OAuth client ID and secret match the web client displayed in the Credentials page of the Google Cloud console (look in the OAuth 2.0 Client IDs section).

Authentication: In my web app, why are sign-in with redirects failing with the following error:
This domain YOUR_REDIRECT_DOMAIN is not authorized to run this operation?

Follow the troubleshooting steps in this FAQ if you're getting the following error:

This domain YOUR_REDIRECT_DOMAIN is not authorized to run this operation.

This error is most likely caused because your redirect domain isn't listed as a authorized domain for Firebase Authentication, or the API key that you use with the Firebase Authentication Service is invalid.

First make sure that YOUR_REDIRECT_DOMAIN is in the list of authorized domains for your Firebase project. If your redirect domain is already listed there, continue to troubleshoot an invalid API key.

By default, Firebase Authentication JS SDK relies on the API key for your Firebase project that's labeled as the Browser key, and it uses this key to verify that a sign-in redirect URL is valid according to the list of authorized domains. Authentication gets this API key depending on how you access the Authentication SDK:

Check to make sure this API key hasn't been deleted: Go to the APIs & Services > Credentials panel in the Google Cloud console where all the API keys for your project are listed.

Authentication: How do I manually construct an OAuth web client?
  1. Open the Credentials page of the Google Cloud console.

  2. At the top of the page, select Create credentials > OAuth client ID.

  3. If you're prompted to configure your consent screen, follow the on-screen instructions, and then continue with the following steps of this FAQ.

  4. Create the OAuth web client:

    1. For the Application Type, select Web application.

    2. For the Authorized JavaScript Origins, add the following:

      • http://localhost
      • http://localhost:5000
      • https://PROJECT_ID.firebaseapp.com
      • https://PROJECT_ID.web.app
    3. For the Authorized Redirect URIs, add the following:

      • https://PROJECT_ID.firebaseapp.com/__/auth/handler
      • https://PROJECT_ID.web.app/__/auth/handler
    4. Save the OAuth client.

  5. Copy the new OAuth client ID and client secret to your clipboard.

  6. In the Firebase console, open the Authentication section.

  7. Within the Sign in method tab, open the Google sign-in provider, and then paste the web server client ID and secret you just constructed and copied from the Google Cloud console. Click Save.

Authentication: How is %APP_NAME% determined for the email template for the confirmation email that can be sent to a user when they sign up using an email address and password?

Before December 2022, the %APP_NAME% in the email template was populated with the OAuth brand name that was automatically provisioned whenever an Android app was registered in the Firebase project. Now, since the OAuth brand is provisioned only when Google sign-in is enabled, the following describes how %APP_NAME% is determined:



Cloud Functions

Visit the Cloud Functions for Firebase FAQ and Troubleshooting page for troubleshooting help and answers to common questions.



Cloud Messaging

Visit the FCM troubleshooting & FAQ page for helpful tips and answers to more FAQs.


Cloud Storage for Firebase

Cloud Storage for Firebase: What are the changes to the default bucket announced in September 2024?

Go to the Cloud Storage documentation to learn more about the Changes for the default Cloud Storage bucket.

Cloud Storage for Firebase: What are the changes to the pricing plan requirements for Cloud Storage announced in September 2024?

Go to the Cloud Storage documentation to learn more about the Changes for pricing plan requirements for Cloud Storage.

Cloud Storage for Firebase: Why am I getting service account permission errors in the console or when using the Cloud Storage for Firebase API (like error code 412)?

Here are some likely reasons for getting these errors:

Cloud Storage for Firebase: Why do I see new or multiple service accounts in my Firebase projects that use Cloud Storage for Firebase?

Firebase uses service accounts to operate and manage services without sharing user credentials. When you create a Firebase project, you might notice that a number of service accounts are already available in your project.

The required service account for Cloud Storage for Firebase is scoped to your project and is named: service-PROJECT_NUMBER@gcp-sa-firebasestorage.iam.gserviceaccount.com.

If you used Cloud Storage for Firebase before September 19, 2022, you may see an additional service account on previously-linked Cloud Storage buckets named: firebase-storage@system.gserviceaccount.com. This old service account is no longer supported as of September 19, 2022.

You can view all service accounts for your project in the Service accounts tab of the Firebase console.

Add the required service account if it's missing

If you deleted the required service account or it's not present in your project, you can do one of the following to add the service account.

In the Firebase console, a missing service account might manifest as a failure to add required IAM permissions.

Remove the required service account

We strongly discourage removing the service account because this may block access to your Cloud Storage buckets from your apps. To remove the service account from your project, follow the instructions in Disabling a service account.



Crashlytics

Visit the Crashlytics troubleshooting & FAQ page for helpful tips and answers to more FAQs.





Hosting

Visit the Firebase Hosting FAQ and Troubleshooting page for answers to common questions.



Performance Monitoring

Visit the Performance Monitoring troubleshooting & FAQ page for helpful tips and answers to more FAQs.



Realtime Database



Remote Config

Visit the Remote Config troubleshooting & FAQ page for helpful tips and answers to more FAQs.



Test Lab

Visit the Test Lab troubleshooting page for helpful tips and answers to FAQs.



Firebase App Indexing