Blaze is pay-as-you-go
When the Google Cloud project already has billing, adding Firebase asks you to confirm the Blaze (pay-as-you-go) plan. [1]
Guides · auth · Popular APIs
Firebase Authentication with email-link sign-in (on an existing Google Cloud project)
Add Firebase to an existing Google Cloud project, turn on email-link (passwordless) sign-in, publish a Firebase Hosting release so the auth handler works, and copy the public web config.
Verified live 24 October 2026Last researched 24 October 2026 · Google · provider site
Who owns what
Firebase is added on top of an existing Google Cloud project; the Google account doing it needs 2-step verification.
- Google account personal owned by the personMust have 2-step verification on to keep accessing Firebase.
- Google Cloud project project · under Google account
- Cloud Billing account billingoptionalIf the project already has billing, adding Firebase asks you to confirm the Blaze (pay-as-you-go) plan.
Have ready
- google/cloud-project-run: An existing Google Cloud project (billing optional).
- A phone or security key for Google 2-step verification · Google requires 2-step verification on the account to keep accessing Firebase [1]Needed for: Turn on 2-step verification for your Google account
- The domain your app runs on (it must be added to the authorised domains) [1]Needed for: Add your app domain to the authorised domains
Steps
Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.
Turn on 2-step verification for your Google account
Google requires 2-step verification (MFA) on the Google account to keep accessing Firebase; the console showed a deadline banner for 26 Oct 2026. You set it up yourself.
Where: https://myaccount.google.com/security
Add Firebase to the existing Google Cloud project
In the Firebase console choose to add a project and pick your existing Google Cloud project. You accept the Firebase terms yourself; the API cannot do this for you. If the project has billing enabled you are asked to confirm the Blaze (pay-as-you-go) plan.
If something goes wrong (2)
Where: https://console.firebase.google.com/
Initialise Authentication (Identity Platform)
Call the Identity Toolkit Admin API initializeAuth for the project (or open Authentication once in the console) before changing any auth configuration.
If something goes wrong (1)
- Updating the auth config fails (
CONFIGURATION_NOT_FOUND): Run initializeAuth first, then retry the config update. [1]
- Updating the auth config fails (
Turn on email-link (passwordless) sign-in
Enable the Email provider with passwordless (email link) sign-in in the project's auth config.
Add your app domain to the authorised domains
The authorised domains list must include the domain your app runs on, or sign-in links will not work there.
Publish a Firebase Hosting release
The project gets a default Hosting site, but it serves nothing until a release is published. Publish one (for example `firebase deploy --only hosting` with a placeholder page) so /__/firebase/init.json is served and the auth action handler works.
If something goes wrong (1)
- Opening a sign-in link shows "The selected page mode is invalid": Publish a Firebase Hosting release on the default site, then request a new link. [1]
Custom action URL (only if you need one)optional
The email action URL cannot be changed through the Admin API. If you want the link to open on your own domain, change it by hand in the console under Authentication, Templates.
If something goes wrong (1)
- Changing the email template or action URL through the API is refused (
EMAIL_TEMPLATE_UPDATE_NOT_ALLOWED): Change it in the Firebase console instead. [1]
Where: https://console.firebase.google.com/
- Changing the email template or action URL through the API is refused (
Register a web app and copy its config
Register a web app in the Firebase project and copy apiKey, authDomain and appId into your environment. These are public web config values, not secrets.
Where: https://console.firebase.google.com/
Terms and gotchas
Plain-English summary, not legal advice. Each card links its source.
2-step verification is required
Google requires 2-step verification on the Google account to keep accessing Firebase; the console showed a deadline of 26 Oct 2026. [1]
What you end up with
| Env var | Secret | Format | What it is |
|---|---|---|---|
FIREBASE_API_KEY | not secret | AIza… (39 characters) | Firebase web API key (public web config, not a secret; restrict it by referrer if you wish) |
FIREBASE_AUTH_DOMAIN | not secret | <project-id>.firebaseapp.com | Auth domain from the web config |
FIREBASE_APP_ID | not secret | 1:<project-number>:web:<hex> | Firebase web app id |
For agents
The same entry as JSON: /api/v1/entries/google/firebase-auth-email-link · requirements /api/v1/requirements/google/firebase-auth-email-link · terms /api/v1/terms/google/firebase-auth-email-link.
Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp
> "What do I need for Firebase Authentication with email-link sign-in (on an existing Google Cloud project), and how long will it take?"
→ tools/call requirements { "provider_id": "google/firebase-auth-email-link" }Sources
- verapli owner's live Firebase Authentication setup for verapli.com (first-hand) Terms acceptance needed before addFirebase works (PERMISSION_DENIED until then); Blaze plan confirmation when billing is on; 2-step verification required to keep accessing Firebase (deadline banner 26 Oct 2026); initializeAuth needed before config (CONFIGURATION_NOT_FOUND); "The selected page mode is invalid" until Hosting has a published release; action URL not changeable via Admin API (EMAIL_TEMPLATE_UPDATE_NOT_ALLOWED); authorised domains must include the app domain · accessed 24 October 2026 · first-hand
Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Google is not affiliated with verapli.