Your login options with Firebase
| Sign-in option | Emails your users get | Test with Proxy Mail QA |
|---|---|---|
| Email and password | A verification link (if your app sends one), password reset links, email change | Yes |
| Email link (passwordless) | A link to sign in | Yes |
| Google, Apple, GitHub and other buttons | None to sign in | No: use an account you own |
| Phone | A text message | No |
If your app uses Supabase, Clerk or another service instead, see which emails each one sends.
Test every login email in five minutes
- Create an address in Proxy Mail QA, with a generated persona if your form asks for a name.
- Sign up on your app. Running it on your own machine is fine to start; check the deployed app before you launch.
- Open the verification link from the row. It gets an Open link button, and Proxy Mail QA never opens it first. On a deployed app, if the link would bring people back to
localhost, we flag it, even when that address is tucked inside Firebase’s own link. - Check you couldn’t use the app before verifying.
- Then reset the password, sign in with the new one, and save it on the row.
Three things to check in Firebase
1. Unverified users. Firebase lets people sign in as soon as they sign up, whether or not they’ve clicked the verification link. Generated code often sends the email but never checks the result. Make sure your app sends the verification email after sign-up and keeps unverified accounts on a “check your email” screen.
2. Authorized domains. Links that bring people back to your app after verifying, resetting a password or signing in by email only work for domains listed under Authentication → Settings → Authorized domains. localhost and your Firebase Hosting addresses are there already; add your custom domain, or links fail with auth/unauthorized-continue-uri.
3. The sender. Under Authentication → Templates you can change the sender’s name, send from your own domain and edit each email. Do it before launch, so people recognise who the email is from.
Using email-link sign-in? Firebase changed how those links work when Dynamic Links shut down: here’s the setup.
Let the agent run the check
Antigravity’s agents can use MCP servers. Add Proxy Mail QA, then ask:
Create a test address with Proxy Mail QA, sign up on the running app with it, wait for the verification link and open it. Then tell me where the link went, and whether the account could use the app before it was verified.
Copy-paste prompts for Antigravity
List every email this app sends: verification, password reset, email-link sign-in, email change and anything else. For each, tell me what triggers it, which URL it continues to, and how long its link stays valid. Flag anything that uses localhost.
After email and password sign-up, send a verification email and keep unverified users on a "check your email" screen with a button to send it again. Enforce it in the Firestore security rules as well, not only in the page.
Make the verification, password reset and email-link sign-in emails continue to the deployed app's address, from an environment variable, and tell me which domain to add to Firebase's authorized domains.