How to change Firebase authDomain to your own domain

New to the setting itself? Start with what Firebase authDomain is. This page is the how-to.

Before you start: pick the domain

• Use the domain that serves your app (for example example.com or app.example.com). Firebase's redirect best-practices guide sets authDomain to "the-domain-that-serves-your-app," which keeps your app and the auth iframe on the same domain.
• Do the steps in this order. Steps 1 to 4 add the new domain alongside the old one, so sign-in keeps working until you flip the config in step 5.
• Leave the old entries in place. Keep https://<project-id>.firebaseapp.com/__/auth/handler on the OAuth client so you can roll back by changing one line.

Step 1: Serve /__/auth/* on your domain

Pick the section that matches where your app is hosted.

Firebase Hosting with a custom domain

Firebase Hosting reserves every path starting with /__ and uses it to serve Firebase Auth's helper pages, so there is nothing to proxy. Connect the domain to Hosting (as of Oct 2026: Hosting page → Add custom domain, add the TXT and DNS records the wizard shows, then wait for the SSL certificate, which Firebase says may take up to 24 hours). Firebase also notes the custom domain must be set up "on the same project you are using for authentication." Details for this setup: Firebase Hosting custom domain and auth.

Any other host: reverse proxy to firebaseapp.com

Firebase's Option 3: forward GET and POST requests for https://<your domain>/__/auth/ to https://<project-id>.firebaseapp.com/__/auth/. Firebase's guide is explicit: "Ensure that this forwarding is transparent to the browser; this cannot be done via a 302 Redirect." A redirect rule (301/302) will not work; you need a rewrite or proxy that keeps your domain in the address bar.

nginx (Firebase's own example):

# reverse proxy for signin-helpers for popup/redirect sign in.
location /__/auth {
  proxy_pass https://<project-id>.firebaseapp.com;
}

Two nginx details: Firebase's example leaves the Host header at nginx's default, which is the host from proxy_pass ($proxy_host). And nginx doesn't pass the server name via TLS SNI to HTTPS upstreams unless you turn it on (proxy_ssl_server_name defaults to off); if the proxied request fails during the TLS handshake, add proxy_ssl_server_name on; inside the location block.

Vercel (vercel.json, using Vercel's documented rewrite to an external origin, which Vercel says lets it "function as a reverse proxy"):

{
  "rewrites": [
    {
      "source": "/__/auth/:path*",
      "destination": "https://<project-id>.firebaseapp.com/__/auth/:path*"
    }
  ]
}

Test this on a preview deployment before relying on it.

Netlify (_redirects, using Netlify's documented proxy rule; status 200 makes it a rewrite rather than a redirect):

/__/auth/*  https://<project-id>.firebaseapp.com/__/auth/:splat  200

Netlify processes "the first matching rule it finds, reading from top to bottom," so put this line above any single-page-app catch-all such as /* /index.html 200.

Test this on a preview deployment before relying on it.

Cloudflare Workers on your own domain: see the dedicated guide, Google sign-in on Cloudflare Workers with your own domain.

Firebase's documentation only gives the nginx example. The Vercel and Netlify rules above follow each host's own rewrite and proxy docs, which don't say which request methods those rules forward. Firebase asks for GET and POST requests to be forwarded, so don't assume POST gets through: check the rule with the test below, then complete a full sign-in with every provider you use.

If you can't run a proxy: self-host the helper files

Firebase's Option 4 is to download the helper files (handler, handler.js, experiments.js, iframe, iframe.js, links, links.js and /__/firebase/init.json) from <project-id>.firebaseapp.com and serve them at the same paths on your domain. Firebase says this "doesn't work for Apple sign-in or SAML," recommends it only when a proxy isn't feasible, and advises re-syncing the files periodically.

Test the proxy before going further

Compare what your domain returns with what Firebase returns. With a transparent proxy, the two responses should match:

curl -s https://<project-id>.firebaseapp.com/__/auth/handler > firebase.html
curl -s https://<your domain>/__/auth/handler > mine.html
diff firebase.html mine.html && echo "Proxy looks right"

If mine.html is your app's own HTML, a 404 page or a redirect, the proxy isn't matching. Common causes: a catch-all rule listed first, a redirect rule instead of a rewrite, or a service worker answering the request. Firebase warns that a service worker must not intercept the /__ namespace: "You must disable any fallbacks for the /__ namespace."

Step 2: Add the new handler URL to your OAuth client

Firebase's guide: "The updated URI to authorize looks like https://<the-domain-that-serves-your-app>/__/auth/handler — the trailing /__/auth/handler is important."

For Google sign-in (console labels as of Oct 2026):

1. In the Firebase console, open Security → Authentication → Sign-in method → Google and note the web client ID in the provider's settings.
2. In the Google Cloud console, open Google Auth Platform → Clients for the same project (older guides: APIs & Services → Credentials) and open the client with that ID.
3. Under Authorized redirect URIs, add https://<your domain>/__/auth/handler. Keep the existing firebaseapp.com entry.
4. Save. Google says changes can take "5 minutes to a few hours" to take effect.

Google requires an exact match: "the http or https scheme, case, and trailing slash ('/') must all match." If you sign in from both example.com and www.example.com, the one set as authDomain is the one that matters here. If you skip this step, Google stops sign-in with Error 400: redirect_uri_mismatch; see how to fix redirect_uri_mismatch.

Other providers (Facebook, GitHub, Microsoft and so on) need the same new URL in their own developer consoles.

Step 3: Add your domain to Google Auth Platform's Authorized domains

Google's brand verification guide says the Authorized domains list on the Branding page "also needs to include the redirect URIs or JavaScript origins" of your Web clients. On the Branding page, add your top private domain (for example example.com for app.example.com) if it isn't already listed. If you plan to submit your branding for verification, Google also asks you to prove ownership of that domain in Google Search Console.

Step 4: Add your domain to Firebase's Authorized domains

As of Oct 2026, Firebase's docs give the path Security → Authentication → Settings tab → Authorized domains → Add domain (older guides call the first part Build → Authentication). You can also go straight to https://console.firebase.google.com/project/_/authentication/settings. Add every host your app signs in from. Without it, sign-in fails with auth/unauthorized-domain. More: Firebase authorized domains.

Step 5: Change authDomain and redeploy

Change only authDomain, using the host name with no https:// and no path. Firebase's guide says that normally "you should not modify any other field in the Firebase config object."

import { initializeApp } from "firebase/app";
import { getAuth } from "firebase/auth";

const firebaseConfig = {
  apiKey: "API_KEY",
  authDomain: "example.com", // was "PROJECT_ID.firebaseapp.com"
  projectId: "PROJECT_ID",
  appId: "APP_ID",
  // ...the rest of your existing config, unchanged
};

export const auth = getAuth(initializeApp(firebaseConfig));

If the value comes from an environment variable on your host, update it there and trigger a new build so the bundle picks it up. On Firebase Hosting, Firebase also says to re-deploy if needed so /__/firebase/init.json is current.

How to confirm it worked

1. On the live site, search the loaded scripts for authDomain and check it shows your domain.
2. In a private window, start Google sign-in. The sign-in window or redirect should go through https://<your domain>/__/auth/handler, not firebaseapp.com.
3. Finish signing in and check that your app receives the user (from signInWithPopup()'s result, or getRedirectResult() after a redirect).
4. If you see redirect_uri_mismatch, re-check step 2 and allow for Google's delay. If you see auth/unauthorized-domain, re-check step 4.

To roll back, set authDomain back to <project-id>.firebaseapp.com and redeploy. Because you kept the old redirect URI, sign-in works again straight away.

Related problems

• Changing the domain in Firebase Auth emails (password reset, email verification) is a separate setting: Firebase documents it under Security → Authentication → Templates with its own DNS records.
• Using a separate auth subdomain such as auth.example.com on Firebase Hosting while your app runs elsewhere: Firebase's Google sign-in guide shows this pattern for changing the domain users see. For signInWithRedirect(), though, the redirect best-practices guide asks for the domain that serves your app, so prefer the proxy above if you use redirects.