Fix "The requested action is invalid" in Firebase Google login

Where this message comes from

When you call signInWithRedirect or signInWithPopup, the Firebase JS SDK sends the browser to https://<your authDomain>/__/auth/handler and adds your apiKey, appName, authType, providerId and redirectUrl (the address of the page you started from) to the address. In the browser SDK, popup and redirect sign-in both send redirectUrl.

That page runs Firebase's helper script, handler.js. In the copy served by Firebase projects (read Oct 2026), "The requested action is invalid." is the default text for the script's internal bad-request error. When that error happens, the page shows the text and stops. It does not return to your app. The script also writes the specific reason to the browser console with console.error:

Related: the same page uses the same internal error with a different message, "Unable to process request due to missing initial state…". That one has its own guide: missing initial state.

Firebase's FAQ covers the sister error on this page ("This domain … is not authorized to run this operation") and names the same suspects: your Authorized domains and your API key. It also notes: "The hostname of the page where you saw this error is your current authDomain."

Step-by-step fix

Step 1: Read the exact reason

1. On the tab or popup that shows the error, open your browser's developer tools and go to the Console.
2. Find the red console.error line and match it to the table above.
3. Note the hostname in the address bar. Per Firebase's FAQ, that is your current authDomain.

Step 2: Check the API key (a likely cause if your domain is already listed)

Firebase's FAQ says the SDK uses your project's Browser key "to verify that a sign-in redirect URL is valid according to the list of authorized domains." If the handler can't make that check, you get this message.

1. In the Google Cloud console, open APIs & Services > Credentials and confirm the key in your firebaseConfig.apiKey still exists. If it was deleted, the FAQ explains how to have Firebase create a new one from Project settings > Your apps.
2. Open the key. Under API restrictions, make sure the Firebase Authentication API is allowed. (Firebase's API key page lists it as identitytoolkit.googleapis.com, "Identity Toolkit API".)
3. Under Application restrictions, if you chose Websites, keep in mind where this check runs: on the handler page, which is on your authDomain, not on your app's domain. Google Cloud's docs say adding https://example.com to a key's website restrictions "means that only calls from https://example.com can use that API key." Firebase doesn't spell out the consequence, but it is a possible cause: if only your app's domain is listed, the handler's call may be refused. Try adding your authDomain host (for example https://<project-id>.firebaseapp.com/*, or your custom auth domain) next to your app's own domain.
4. Confirm apiKey in your app's config is the key from your Firebase project's web app settings, not one from another project.

Firebase's docs warn: "For API keys in use by production apps, be cautious about changing its restrictions or limits."

Step 3: Check Authorized domains

1. In the Firebase console, go to Security > Authentication > Settings > Authorized domains (as of Oct 2026; older guides say Build > Authentication, and some say the Sign-in method tab).
2. Add the exact host of the page where users click "Sign in", for example app.example.com. See Firebase authorized domains for the rules.

If you remove the domain and the error changes to an "unauthorized" error, that is expected: for redirect sign-in, the SDK checks your origin itself before leaving the page. A FlutterFlow user reported exactly this switch in August 2025. Put the domain back and continue with Step 2.

Step 4: Make sure the handler URL arrives intact

The handler needs the query string the SDK builds. This step matters most if you serve /__/auth/ from your own domain.

1. In the Network tab, find the request to /__/auth/handler. Its URL should include apiKey=, authType= and providerId=google.com.
2. Don't build /__/auth/handler links by hand. Let signInWithRedirect or signInWithPopup create them.
3. If you proxy /__/auth/ to <project-id>.firebaseapp.com, forward the full path and query string unchanged. Firebase's docs say the forwarding must be "transparent to the browser; this cannot be done via a 302 Redirect."

Step 5: Check that your authDomain serves your project's handler

1. Confirm the handler is Firebase's, not your app or a 404:

bash curl -s https://<your-authDomain>/__/auth/handler | grep -o 'handler.js'

Firebase's handler page loads handler.js. If you get your app's HTML or a 404, your authDomain isn't serving the handler yet. See the Firebase auth handler.

2. On Firebase Hosting, Firebase's FAQ says to make sure authDomain uses one of the domains of that Hosting site, and to check https://<authDomain>/__/firebase/init.json: its projectId should match the one in your firebaseConfig.

3. If you self-host the helper files (Firebase's "Option 4"), the FAQ says the API key and projectId in your /__/firebase/init.json "should match your web app firebaseConfig." Firebase also recommends "downloading and syncing the files periodically." Whether you need init.json at all depends on your setup: see Do I need init.json?. A missing init.json is not a documented cause of this message on its own; what the FAQ warns about is a file that doesn't match your config.

How to confirm it worked

1. Start sign-in again. The handler page should pass straight through to Google's account chooser.
2. After choosing an account, you land back in your app, and getRedirectResult(auth) (redirect) or signInWithPopup (popup) resolves with the signed-in user.
3. The console on the handler page shows no console.error lines.

Related problems

• The handler URL loads your own app or a 404: Firebase auth handler.
• Choosing or changing your authDomain: Firebase authDomain.