Firebase authDomain: what it is, where to find it, and when to change it

Where to find authDomain

In the Firebase console (steps from Firebase support, as of Oct 2026):

1. Open Project settings with the gear icon.
2. In the Your apps card, select the nickname of your web app.
3. In the Firebase SDK snippet pane, choose Config and copy the object.

It looks like this (Firebase's own example, with placeholders):

import { initializeApp } from "firebase/app";
import { getAuth } from "firebase/auth";

const firebaseConfig = {
  apiKey: "API_KEY",
  authDomain: "PROJECT_ID.firebaseapp.com",
  projectId: "PROJECT_ID",
  storageBucket: "PROJECT_ID.firebasestorage.app",
  messagingSenderId: "SENDER_ID",
  appId: "APP_ID",
};

const app = initializeApp(firebaseConfig);
export const auth = getAuth(app);

In your code: search the project for authDomain. It usually sits in a file like firebase.js, firebase.ts or lib/firebase.ts, often read from an environment variable. If an AI tool generated the app, ask it where authDomain is set and which environment variable feeds it.

In the live site: the value you deployed can differ from the one in your editor (for example, a stale environment variable on your host). Open your deployed site, open the browser's developer tools, and search the loaded scripts for authDomain.

What the value must look like

authDomain is a host name only: no https://, no path, no trailing slash. The Firebase JS SDK builds the helper URLs itself as https://${authDomain}/__/auth/handler and https://${authDomain}/__/auth/iframe, so a value like https://example.com/ produces a broken URL.

If authDomain is missing entirely, the SDK throws auth/auth-domain-config-required with the message "Be sure to include authDomain when calling firebase.initializeApp()…".

What authDomain controls

• Where the sign-in helper runs. Firebase's redirect guide says "authDomain hosts the sign-in helper code that redirects to the Identity Provider, which, on success, redirects back to the app domain." The SDK opens https://<authDomain>/__/auth/handler for popup and redirect sign-in, and loads https://<authDomain>/__/auth/iframe in the background. More on that endpoint: what /__/auth/handler is.
• The domain Google shows while signing in. Firebase's Google sign-in guide says the default subdomain is "used as the redirect mechanism for OAuth sign in," so users "may see that domain while signing in to Google," for example "Continue to: https://my-app-12345.firebaseapp.com." Why that line appears: Why Google says "continue to firebaseapp.com".
• Which redirect URI Google expects. The OAuth client used for Google sign-in must list https://<authDomain>/__/auth/handler as an authorized redirect URI. For the default host, Firebase's FAQ lists https://<project-id>.firebaseapp.com/__/auth/handler (and the web.app equivalent) as the web client's redirect URIs.

Is it OK that apiKey and authDomain are public?

Yes. Firebase describes the config object as "unique, but non-secret identifiers for your Firebase project and app." Its API key page says API keys for Firebase services "only identify your Firebase project and app to those services" and are "OK to include in code or checked-in config files." Access to your data is controlled by Firebase Security Rules, App Check and IAM, not by hiding the key. Firebase still recommends applying API restrictions to your keys.

Firebase also says you should not edit the config object by hand, especially apiKey, projectId and appId. The stated exception is authDomain, which you can change by following Firebase's redirect best-practices guide.

When to change authDomain

Keep the default if your app runs on Firebase Hosting at <project-id>.firebaseapp.com: Firebase's redirect guide says those apps are "not affected by this issue and no action is needed."

Change it when either of these applies:

1. Your app uses signInWithRedirect() on its own domain. Firebase's guide (checked Oct 2026) says: "Starting June 24 2024, implementing one of the options will be required for redirect sign-in to work on Google Chrome M115+. This is already required on Firefox 109+ and Safari 16.1+." Options 1, 3 and 4 in that guide all point authDomain at the domain that serves your app.
2. You want Google's sign-in screen to show your domain instead of <project-id>.firebaseapp.com.

Changing the one line is not enough on its own. Your domain must then serve /__/auth/*, the new handler URL must be an authorized redirect URI, and your domain must be in Firebase's Authorized domains list. The step-by-step guide for each host is here: how to change authDomain to your own domain.

How to confirm which authDomain you have

1. Read the deployed value in your browser's developer tools, as above.
2. Read the error page's host. If redirect sign-in fails with "This domain YOUR_REDIRECT_DOMAIN is not authorized to run this operation," Firebase's FAQ notes that "the hostname of the page where you saw this error is your current authDomain."
3. Check that the host serves Firebase's config (Firebase Hosting, or a proxy that also forwards /__/firebase/init.json). Firebase's FAQ suggests opening https://<authDomain>/__/firebase/init.json and checking that its projectId matches the one in your firebaseConfig.
4. Start Google sign-in in a private window and read the domain Google names on its screen.

Related problems

• auth/unauthorized-domain: the page's host is missing from Firebase's list. See Firebase authorized domains.
• Error 400: redirect_uri_mismatch after changing authDomain: the new handler URL isn't on the OAuth client yet.
• Redirect sign-in returns no user on your own domain: see signInWithRedirect not working.