Firebase authorized domains: where the list lives and what to add

Where the list is in the Firebase console

Firebase's docs give this click path (checked Oct 2026):

1. Open your project in the Firebase console.
2. Go to Security > Authentication, then open the Settings tab.
3. In the Authorized domains section, click Add domain and enter the host name.

Older guides and screenshots put Authentication under Build > Authentication, and some show the list on the Sign-in method tab. If your console looks different, open Authentication and look for its Settings tab; Firebase's troubleshooting page calls it "the Authentication settings dashboard".

If you use Google Cloud Identity Platform, the same list is in the Google Cloud console: Identity Platform > Identity providers, then Add Domain in the Project settings side pane (as of Oct 2026). It is one project-level list, stored as the authorizedDomains field of your project's config, which Google describes as the "List of domains authorized for OAuth redirects".

"Firebase allowed domains" and "whitelisted domains" (the wording in some older Google pages and error messages) mean this same list.

What's on the list by default

• Your Firebase Hosting domain. Firebase's help page on redirect domains (undated) says your Firebase project's hosting domain is allowed by default. That page also still lists localhost as a default, which Firebase's newer docs contradict for recent projects (next point). That is usually PROJECT_ID.firebaseapp.com, the same host as the default authDomain in your web config. Firebase notes that some Hosting domains don't use the project ID, so check what your project actually shows.
• localhost, on older projects only. Firebase's docs: "In projects created after April 28, 2025, Firebase Authentication no longer includes localhost as an authorized domain by default." Projects created before that date may still have it.

Open your own list once before you change anything. It is the source of truth for your project.

Which hosts to add

Enter the bare host name: app.example.com, not https://app.example.com/login and not app.example.com:3000. Google's help page says adding a domain allows requests "from any URL and port of that domain", and that you must add the full domain name of every other host your app uses.

If localhost is on your production project's list, Firebase suggests removing it so that code running on someone else's machine can't use your production project.

The error you get when a host is missing

When the page's host isn't on the list, the Firebase JS SDK stops sign-in with this error (text from the SDK's error table):

Firebase: Error (auth/unauthorized-domain).
This domain is not authorized for OAuth operations for your Firebase project. Edit the list of authorized domains from the Firebase console.

For email links and password-reset links, a continue URL on an unlisted host gives a different code, auth/unauthorized-continue-uri ("The domain of the continue URL is not whitelisted").

Already added the host and still see the error? Work through Firebase authorized domains not working.

Authorized domains vs authDomain vs OAuth redirect URIs

Three settings with similar names live in three places.

Adding your domain to authorized domains lets sign-in start from it. It does not change the host Google's sign-in screen shows; that follows authDomain. What authDomain is: Firebase authDomain explained. Moving it to your own domain takes more than one setting, and the steps are in How to change your Firebase authDomain.

Change the list by API, Terraform or CLI

Identity Toolkit Admin API (v2)

The list is the authorizedDomains field of projects/PROJECT_ID/config. PATCH replaces the whole field, so read the list, add your host, and write the full list back. Firebase's own CLI does exactly this: its helper reads the current domains, then sends "the full list of authorized domains" with updateMask set to authorizedDomains.

PROJECT_ID="your-project-id"
TOKEN="$(gcloud auth print-access-token)"

# 1. Read the current list
curl -s \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "x-goog-user-project: ${PROJECT_ID}" \
  "https://identitytoolkit.googleapis.com/admin/v2/projects/${PROJECT_ID}/config"

# 2. Write the full list back, including the new host
curl -s -X PATCH \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "x-goog-user-project: ${PROJECT_ID}" \
  -H "Content-Type: application/json" \
  -d '{"authorizedDomains": ["your-project-id.firebaseapp.com", "your-project-id.web.app", "example.com", "www.example.com"]}' \
  "https://identitytoolkit.googleapis.com/admin/v2/projects/${PROJECT_ID}/config?updateMask=authorizedDomains"

• Replace the list in step 2 with what step 1 returned plus your new host. Anything you leave out is removed.
• The x-goog-user-project header sets the quota project. Google says to add it when a call returns an error saying user credentials are not supported or the quota project is not set, and the caller needs serviceusage.services.use on that project. Firebase's CLI sends the header on both calls.
• The caller needs firebaseauth.configs.get to read and firebaseauth.configs.update to write. The Identity Toolkit Admin and Identity Toolkit Editor roles include both.
• The token needs one of the scopes Google lists for this method, such as https://www.googleapis.com/auth/cloud-platform.

Run it against a development project first.

Terraform

Firebase's Terraform guide sets the list with the authorized_domains argument of the google_identity_platform_config resource. Its example lists localhost, PROJECT_ID.firebaseapp.com and PROJECT_ID.web.app. Leave localhost out of production configs.

Firebase CLI

Firebase's docs describe no CLI command for editing this list (checked Oct 2026). According to the firebase-tools source, firebase hosting:channel:deploy adds each preview channel's host to the list unless you pass --no-authorized-domains, and removes the hosts of expired channels during later channel deploys. If the CLI can't update the list, it prints a warning and the deploy carries on, so check the list after a preview deploy instead of assuming.

How to confirm a host is on the list

1. Reload the Authorized domains list in the console and look for the exact host.
2. Or run the GET call above and look for the host in authorizedDomains.
3. Fully reload your app on that host, then start sign-in. The SDK checks the list once per page load and keeps that result, so an already-open tab can keep failing after you add the host.

Related problems

• Added the host and it still fails: Firebase authorized domains not working
• Subdomains, preview URLs and customer domains: Firebase authorized domains: wildcards and subdomains
• Local development: auth/unauthorized-domain on localhost