Connect a custom domain to Firebase Hosting and use it for sign-in

Before you start

• Use the same Firebase project for Hosting and Auth. Firebase's docs say to set up the custom domain on the same project you use for authentication.
• You need a Hosting site. Finish the "Get Started" wizard on your project's Hosting page first.
• Limits: each custom domain can connect to only one Hosting site, and Firebase limits each apex domain to 20 subdomains because of SSL certificate limits.

Part 1: Connect the domain to Firebase Hosting

Step 1: Start the wizard (console UI as of Oct 2026)

On your project's Hosting page:

• With one Hosting site, click Add custom domain.
• With more than one site, click View on the site, then Add custom domain.

Enter the domain (for example app.example.com or example.com). The optional checkbox redirects all requests on this domain to a second domain, for example sending example.com to www.example.com. Click Continue.

Step 2: Prove you own the domain (TXT record)

If the wizard asks you to verify your apex domain, add this record at your DNS provider:

Then:

1. Allow up to 24 hours for the record to propagate, then click Verify. Firebase says this usually happens within a few hours.
2. If Verify shows an error, the record hasn't propagated yet or the value is wrong. You can check what's live with the Google Admin Toolbox Dig tool.
3. Leave this TXT record in place for good. Hosting uses it to confirm ownership and to renew your SSL certificate.

You can click Cancel and come back later. Waiting doesn't reset propagation, but you'll need to re-enter the domain name.

Step 3: Point the domain at Hosting

The wizard offers two modes:

• Quick Setup, for a new domain that isn't serving traffic yet. Add the records the wizard shows: the host is your domain key and the values are the IP addresses it gives you.
• Advanced Setup, for moving a live site with no downtime. First add a TXT record in the form hosting-site=<site_id> (plus a pair of CAA records if the wizard asks), and complete an ACME challenge, either a DNS TXT record or a file uploaded to your current site. Once the certificate is ready, add the A/AAAA records the wizard shows. Your old host keeps serving traffic until the status changes to Connected.

Delete conflicting records. For Quick Setup, Firebase's docs say to remove any A or CNAME records that point to other providers, and any AAAA records. If any of these exist, Firebase can't issue an SSL certificate. (Advanced Setup may ask you to add AAAA records itself; keep the ones the wizard gives you.)

Host key reference:

Step 4: Wait for SSL and read the status

Firebase says the certificate can take up to 24 hours after you point DNS at Hosting. While it's being issued, you may see an invalid certificate without your domain name. That's expected and clears once the certificate is ready.

Part 2: Use the connected domain as your authDomain

Why bother? By default Firebase uses https://<project-id>.firebaseapp.com for OAuth, and its docs say users may see Continue to: https://my-app-12345.firebaseapp.com while signing in to Google. Setting your connected domain as authDomain replaces that. It's also Firebase's recommended fix (Option 1) for signInWithRedirect when you host on Firebase Hosting with a custom domain or a web.app subdomain.

Why no proxy? Firebase Hosting reserves URLs starting with /__, and Firebase Authentication uses that path for its OAuth helper pages. Reserved /__/* paths come first in Hosting's response order, ahead of redirects, static files and rewrites. So a catch-all rewrite to index.html won't hide /__/auth/handler. Firebase's Google sign-in guide states the redirect page "will be accessible on your custom domain" at /__/auth/handler.

Step 5: Add the domain to authorized domains

As of Oct 2026, Firebase's docs give Security > Authentication > Settings > Authorized domains > Add domain. Older guides use Build > Authentication > Settings. Add the exact domain your users load, for example app.example.com.

Step 6: Add the redirect URI for Google

As of Oct 2026, open the Google Auth Platform > Clients page in the Google Cloud console (older guides say Credentials), choose the web client created for your Firebase project, and add:

https://app.example.com/__/auth/handler

Google says changes to these settings can take 5 minutes to a few hours to apply. For other OAuth providers, add the same URI in their console. For SAML, add the new domain to the Assertion Consumer Service (ACS) URL.

Step 7: Change authDomain and redeploy

import { initializeApp } from "firebase/app";
import { getAuth } from "firebase/auth";

const firebaseConfig = {
  apiKey: "...",
  authDomain: "app.example.com", // was "your-project-id.firebaseapp.com"
  projectId: "your-project-id",
  appId: "...",
};

export const auth = getAuth(initializeApp(firebaseConfig));

Change only authDomain. Firebase's docs say you normally shouldn't change any other field. Then run firebase deploy --only hosting.

If you used the redirect checkbox in Step 1, set authDomain to the domain that actually serves your app, not the one that redirects. Firebase's placeholder for this value is literally <the-domain-that-serves-your-app>.

If your app is a PWA, Firebase says you must disable any service worker navigation fallback for the /__ path. For the sw-precache library, Firebase's example is:

{
  navigateFallbackWhitelist: [/^(?!\/__).*/]
}

How to confirm it worked

1. The domain shows Connected on the Hosting page.
2. https://app.example.com/__/firebase/init.json returns your project's Firebase config as JSON. This is a reserved Hosting URL, so it shows that Hosting, not your app, is answering /__/ paths on this domain.
3. Click your Google sign-in button. The account chooser should no longer say firebaseapp.com. If it shows example.com rather than app.example.com, see why Google shows yourapp.com and not app.yourapp.com.
4. Sign-in completes with no auth/unauthorized-domain and no redirect_uri_mismatch. If Google shows the mismatch error, recheck Step 6 or see redirect_uri_mismatch.

Related problems

• Changing authDomain in an app that already has users: how to change authDomain.
• App served by Cloud Run behind Hosting: Firebase Auth with Cloud Run.
• Not on Firebase Hosting? On Cloudflare Pages you forward /__/auth/ yourself: Firebase Auth on Cloudflare Pages.