{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"22149961c9151327693df96b01749659414ebfddbc8270cea31f3687cf977275","entry":{"id":"google/firebase-auth-email-link","name":"Firebase Authentication with email-link sign-in (on an existing Google Cloud project)","vendor":"Google","summary":"Add Firebase to an existing Google Cloud project, turn on email-link (passwordless) sign-in, publish a Firebase Hosting release so the auth handler works, and copy the public web config.","aliases":["firebase-auth","firebase-email-link","identity-platform","firebase/hosting-default-site"],"category":"auth","group":"C","homepage":"https://firebase.google.com/","docs":["https://firebase.google.com/docs/auth/web/email-link-auth","https://cloud.google.com/identity-platform/docs/reference/rest"],"status":"verified","last_verified":"2026-10-24","last_researched":"2026-10-24","verified_by":["jon"],"sources":[{"id":"owner-session","url":"https://console.firebase.google.com/","title":"verapli owner's live Firebase Authentication setup for verapli.com (first-hand)","accessed":"2026-10-24","supports":"Terms acceptance needed before addFirebase works (PERMISSION_DENIED until then); Blaze plan confirmation when billing is on; 2-step verification required to keep accessing Firebase (deadline banner 26 Oct 2026); initializeAuth needed before config (CONFIGURATION_NOT_FOUND); \"The selected page mode is invalid\" until Hosting has a published release; action URL not changeable via Admin API (EMAIL_TEMPLATE_UPDATE_NOT_ALLOWED); authorised domains must include the app domain","kind":"first_hand"}],"allowed_domains":["console.firebase.google.com","console.cloud.google.com","myaccount.google.com"],"account_model":{"summary":"Firebase is added on top of an existing Google Cloud project; the Google account doing it needs 2-step verification.","accounts":[{"name":"Google account","kind":"personal","owned_by":"the person","required":true,"note":"Must have 2-step verification on to keep accessing Firebase."},{"name":"Google Cloud project","kind":"project","parent":"Google account","required":true},{"name":"Cloud Billing account","kind":"billing","required":false,"note":"If the project already has billing, adding Firebase asks you to confirm the Blaze (pay-as-you-go) plan."}]},"prerequisites":[{"entry":"google/cloud-project-run","note":"An existing Google Cloud project (billing optional)."}],"have_ready":[{"kind":"phone_for_2fa","description":"A phone or security key for Google 2-step verification","why":"Google requires 2-step verification on the account to keep accessing Firebase","needed_for":["enable-2sv"],"auto_check":"none","source":"owner-session"},{"kind":"live_website","description":"The domain your app runs on (it must be added to the authorised domains)","needed_for":["authorised-domains"],"auto_check":"none","source":"owner-session"}],"steps":[{"id":"enable-2sv","title":"Turn on 2-step verification for your Google account","summary":"Google requires 2-step verification (MFA) on the Google account to keep accessing Firebase; the console showed a deadline banner for 26 Oct 2026. You set it up yourself.","route":"guided","depends_on":[],"gate":"2fa","url":"https://myaccount.google.com/security","preflight":["mfa_enabled"],"sources":["owner-session"]},{"id":"add-firebase","title":"Add Firebase to the existing Google Cloud project","summary":"In the Firebase console choose to add a project and pick your existing Google Cloud project. You accept the Firebase terms yourself; the API cannot do this for you. If the project has billing enabled you are asked to confirm the Blaze (pay-as-you-go) plan.","route":"guided","depends_on":["enable-2sv"],"gate":"human_terms","url":"https://console.firebase.google.com/","recovery":[{"hiccup":"The addFirebase API call is refused","code":"PERMISSION_DENIED","fix":"Accept the Firebase terms once in the Firebase console (human), then retry.","source":"owner-session"},{"hiccup":"A Blaze plan confirmation appears","fix":"Expected when the project already has billing. Read the pricing and confirm only if you agree.","source":"owner-session"}],"sources":["owner-session"]},{"id":"initialize-auth","title":"Initialise Authentication (Identity Platform)","summary":"Call the Identity Toolkit Admin API initializeAuth for the project (or open Authentication once in the console) before changing any auth configuration.","route":"api","depends_on":["add-firebase"],"gate":"none","recovery":[{"hiccup":"Updating the auth config fails","code":"CONFIGURATION_NOT_FOUND","fix":"Run initializeAuth first, then retry the config update.","source":"owner-session"}],"sources":["owner-session"]},{"id":"enable-email-link","title":"Turn on email-link (passwordless) sign-in","summary":"Enable the Email provider with passwordless (email link) sign-in in the project's auth config.","route":"api","depends_on":["initialize-auth"],"gate":"none","sources":["owner-session"]},{"id":"authorised-domains","title":"Add your app domain to the authorised domains","summary":"The authorised domains list must include the domain your app runs on, or sign-in links will not work there.","route":"api","depends_on":["initialize-auth"],"gate":"none","sources":["owner-session"]},{"id":"hosting-release","title":"Publish a Firebase Hosting release","summary":"The project gets a default Hosting site, but it serves nothing until a release is published. Publish one (for example `firebase deploy --only hosting` with a placeholder page) so /__/firebase/init.json is served and the auth action handler works.","route":"guided","depends_on":["add-firebase"],"gate":"none","recovery":[{"hiccup":"Opening a sign-in link shows \"The selected page mode is invalid\"","fix":"Publish a Firebase Hosting release on the default site, then request a new link.","source":"owner-session"}],"sources":["owner-session"]},{"id":"action-url","title":"Custom action URL (only if you need one)","summary":"The email action URL cannot be changed through the Admin API. If you want the link to open on your own domain, change it by hand in the console under Authentication, Templates.","route":"guided","depends_on":["enable-email-link"],"gate":"human_submit","url":"https://console.firebase.google.com/","recovery":[{"hiccup":"Changing the email template or action URL through the API is refused","code":"EMAIL_TEMPLATE_UPDATE_NOT_ALLOWED","fix":"Change it in the Firebase console instead.","source":"owner-session"}],"optional":true,"sources":["owner-session"]},{"id":"web-config","title":"Register a web app and copy its config","summary":"Register a web app in the Firebase project and copy apiKey, authDomain and appId into your environment. These are public web config values, not secrets.","route":"guided","depends_on":["add-firebase"],"gate":"none","url":"https://console.firebase.google.com/"}],"outputs":[{"name":"FIREBASE_API_KEY","description":"Firebase web API key (public web config, not a secret; restrict it by referrer if you wish)","secret":false,"example_format":"AIza… (39 characters)","from_step":"web-config"},{"name":"FIREBASE_AUTH_DOMAIN","description":"Auth domain from the web config","secret":false,"example_format":"<project-id>.firebaseapp.com","from_step":"web-config"},{"name":"FIREBASE_APP_ID","description":"Firebase web app id","secret":false,"example_format":"1:<project-number>:web:<hex>","from_step":"web-config"}],"terms_notes":[{"kind":"rules_say","severity":"amber","title":"Blaze is pay-as-you-go","text":"When the Google Cloud project already has billing, adding Firebase asks you to confirm the Blaze (pay-as-you-go) plan.","source":"owner-session"},{"kind":"rules_say","severity":"red","title":"2-step verification is required","text":"Google requires 2-step verification on the Google account to keep accessing Firebase; the console showed a deadline of 26 Oct 2026.","source":"owner-session"}],"api_provisioning":{"available":"partial","notes":"Auth config (initializeAuth, sign-in providers, authorised domains) works through the Identity Toolkit Admin API. Accepting the Firebase terms and changing the email action URL need the console.","source":"owner-session"},"notes":["Firebase Hosting default site is folded into this entry (step hosting-release) rather than kept as a separate entry."]}}