---
title: "Firebase sign-up and login problems in testing, and fixes · Proxy Mail QA"
description: "Why Firebase Authentication emails don’t arrive, verified users still look unverified, links fail with invalid-action-code, and sign-ups hit limits."
url: https://proxymail.qa/solve/firebase-auth-problems
---

1. [Home](https://proxymail.qa/)
2. [What we solve](https://proxymail.qa/solve)

# Common Firebase sign-up and login problems, and how to fix them

Firebase Authentication rarely errors loudly. A verification email that was never requested, a reset email for an address it won’t confirm exists, a user who verified but still looks unverified: each one looks like nothing happened. Here’s what’s going on and what to change.

Updated 23 October 2026

Details below are from Firebase’s documentation on 23 October 2026\. Check it for current limits. For the basics, what Firebase sends and how to test it, start with [Test Firebase Authentication emails](https://proxymail.qa/auth/firebase).

## The email never arrives

**Nothing asked for it.** `createUserWithEmailAndPassword` creates the account and sends no email. Your sign-up code has to call `sendEmailVerification` for the new user. If it doesn’t, the account sits unverified and the tester waits for nothing.

**The address has no account.** With email enumeration protection, on by default for projects created on or after 15 September 2023, `sendPasswordResetEmail` sends only when the address belongs to an account, and returns no error when it doesn’t. A reset test with an address that never signed up passes in your app and receives nothing. Sign up first, then reset.

**A daily limit ran out.** On the free Spark plan, Firebase sends 5 email-link sign-ins a day, 150 password resets and 1,000 verification emails. Passwordless sign-in stops after the fifth test of the day. Add billing (Blaze) for staging, or test email-link sign-in sparingly.

**It’s in spam.** By default the emails come from `noreply@` your project’s `firebaseapp.com` address, which some inboxes distrust. Set up your own domain in the console’s email templates. A Proxy Mail QA address receives them either way, so you can tell “not sent” from “sent to spam”.

**You’re using the emulator.** The Auth emulator doesn’t send email: it prints each verification, reset and sign-in link in the terminal where it runs and in the Emulator Suite’s Logs tab, and offers them on a REST endpoint for tests. Test against a real staging project before launch.

## Sign-up fails

- **`auth/email-already-in-use`:** the address has an account. Enumeration protection doesn’t hide this one. Use a fresh address for every run.
- **Too many sign-ups:** Firebase allows 100 new accounts an hour from one IP address. A test suite running from one CI machine can pass that. You can schedule a temporary increase in the Firebase console.
- **Password rules:** with a password policy switched on, a weak password fails with `auth/password-does-not-meet-requirements`. Make sure your form says why.
- **Bot protection:** reCAPTCHA protection or App Check enforcement on Authentication can turn away automated browsers. For App Check, give your test runs a debug token.

## Sign-in fails with `auth/invalid-credential`

With enumeration protection, a wrong password and an unknown address give the same error (`INVALID_LOGIN_CREDENTIALS`, which the web SDK reports as `auth/invalid-credential`). Tests that expect `auth/user-not-found` or `auth/wrong-password` start failing, and so do apps that show a different message for each. Check for the single error instead.

## The link was clicked, but the app still says “verify your email”

The `User` object your app holds keeps the `emailVerified` value it had when the person signed in. After they click the link in another tab, call `user.reload()`, and `user.getIdToken(true)` if your security rules or backend read the `email_verified` claim. Until then, the app and your rules still see an unverified user.

## The link fails

- **`auth/invalid-action-code` or `auth/expired-action-code`:** the link was used already or has expired. Request a new email and use the newest one.
- **`auth/unauthorized-continue-uri`:** the continue URL your code passes isn’t on an authorized domain. Add each environment under Authentication, Settings, Authorized domains. Preview deployments get new domains, so each one needs adding, or use a fixed staging domain.
- **It goes to localhost:** the continue URL comes from your code. Build it from an environment setting rather than a hard-coded `http://localhost`. More in [why emails link to localhost](https://proxymail.qa/solve/localhost-links).

## Email-link sign-in asks for the email again

Email-link sign-in finishes in the browser that asked for the link: your app stores the address there (usually in `localStorage`) and reads it back when the link opens. Open the link on another device or browser, and Firebase’s own guidance is to ask for the address again, to prevent session fixation. That’s expected. Testers should open the link where they started. In a mobile app, the link also has to open the app, which works differently since Dynamic Links shut down: see [Firebase email-link sign-in for mobile apps](https://proxymail.qa/mobile/firebase-email-link).

## Check them all in one pass

1. Create a fresh Proxy Mail QA address for each scenario: new user, password reset (on an address you’ve signed up), email-link sign-in.
2. Go through the flow in your app. The link appears on the address’s row within seconds, or never, which tells you nothing was sent.
3. Look at the row: a link to localhost is flagged, and the inbox shows each email’s sender and checks. `checkEmail` with `expectHost` fails a test whose link leads anywhere but your site.
4. Open the link in the same browser, then check your app shows the user as verified without signing out and in again.

Built with Antigravity or another AI tool? [Problems in vibe-coded sign-up and login](https://proxymail.qa/solve/vibe-coded-login-problems) covers what generated apps usually get wrong on top of these.

## Automating this?

Make each of these a test: a fresh address per run, waitForLink for the verification or reset link, countEmails to check exactly one arrived, and checkEmail with expectHost so a link that leads anywhere else fails.

[Node.js client](https://proxymail.qa/docs/node) [Python](https://proxymail.qa/docs/python) [Set up your coding agent](https://proxymail.qa/docs/api#agent-setup)

## Try it on your next sign-up test

Free plan, no credit card. Create an address and watch the code or link arrive.

[Create a free account](https://app.proxymail.qa/?mode=signup&from=site-solve-firebase-auth-problems)

## Questions

### Why didn’t Firebase send a verification email after sign-up?

Creating an account with createUserWithEmailAndPassword sends nothing. Your app has to call sendEmailVerification for the new user, and many sign-up forms never do.

### Why does a password reset for an unknown address say it worked?

With email enumeration protection, on by default for projects created since 15 September 2023, Firebase sends a reset email only when the address has an account, and never says when it doesn’t. Test resets with an address you’ve signed up first.

### The user clicked the verification link. Why does my app still say they’re unverified?

The signed-in user object keeps the state it had at sign-in. Call reload() on the user, and getIdToken(true) if your security rules read email\_verified, or sign in again.

### How many emails can a free project send?

On the Spark plan, 1,000 verification emails, 150 password resets and only 5 email-link sign-ins a day. Blaze raises them. The full table is in Test Firebase Authentication emails.

## Related guides

- [Test sign-up and email verificationA fresh, private address for every sign-up test, with the verification link or code ready the moment it lands.](https://proxymail.qa/solve/email-verification-testing)
- [Test OTP and one-time login codesCodes pulled out of the email with a Copy button and a countdown when the email says how long they last.](https://proxymail.qa/solve/otp-code-testing)
- [Test magic links and passwordless sign-inSingle-use links that are never opened or prefetched on our side, so they still work when you click them.](https://proxymail.qa/solve/magic-link-testing)
- [Test password reset emailsRequest, receive and use reset links, and keep the new password saved next to the test account.](https://proxymail.qa/solve/password-reset-testing)
- [Stop sharing one Gmail inbox for QAPrivate, disposable addresses for every tester instead of one shared mailbox and a pile of plus-addresses.](https://proxymail.qa/solve/shared-test-inbox)
- [Take QA notes by voice with Wispr FlowDictate what each test account is for, its state and what you found, straight into its notes, in seconds.](https://proxymail.qa/solve/voice-notes-wispr-flow)
- [Verification link points to localhost:3000Why emails from staging link to localhost, how to fix it in Supabase, Firebase and other stacks, and how we flag it.](https://proxymail.qa/solve/localhost-links)
- [Common Supabase sign-up and login problemsEmails that never arrive, links that expire or sign nobody in, and sign-ups that fail, with the fix for each.](https://proxymail.qa/solve/supabase-auth-problems)
- [Sign-up and login problems in vibe-coded appsThe login bugs AI-built apps usually ship with: emails only you receive, links to the preview, missing pages, and what to ask the builder.](https://proxymail.qa/solve/vibe-coded-login-problems)
- [Test sign-up emails in PlaywrightA complete Playwright test for sign-up codes and links, from a fresh inbox to the report on the pull request.](https://proxymail.qa/solve/playwright-email-tests)
- [Test sign-up emails in CypressA complete Cypress test for sign-up links and codes, with the email waits running as Cypress tasks.](https://proxymail.qa/solve/cypress-email-tests)
- [Test sign-up emails with pytestA complete pytest test for sign-up codes and links, with Playwright for Python or Selenium and a one-file helper.](https://proxymail.qa/solve/pytest-email-tests)
- [Test coupon codes and welcome offersThe coupon with its discount, end date and arrival time, what checkout did with it, and a failure when an expired or reused one is accepted.](https://proxymail.qa/solve/coupon-code-testing)
- [Test unsubscribe links and one-click unsubscribeThe unsubscribe headers and link checked on every marketing email, and a watch that flags any marketing after unsubscribing, with no time limit.](https://proxymail.qa/solve/unsubscribe-testing)
- [Test that a welcome offer can't be claimed twiceVersions of one address that reach the same inbox, and a check that fails when the same person got the offer more than once.](https://proxymail.qa/solve/welcome-offer-abuse)

[Built your app with an AI tool? Pick yours](https://proxymail.qa/built-with)

Firebase is a trademark of Google LLC. Proxy Mail QA is independent and isn’t affiliated with or endorsed by them.