How to fix auth/operation-not-allowed in Firebase

FirebaseBEGINNERMEDIUMUpdated Dec 22, 2025· 322 views

The "auth/operation-not-allowed" error occurs when a sign-in provider is disabled in your Firebase project. Enable the required authentication method in the Firebase console Sign-in Method tab to resolve this issue.

Quick fix

Fixes auth/operation-not-allowed

Navigate to https://console.firebase.google.com and click on your project from the dashboard.
  1. Open Firebase Console and select your project
  2. Go to Authentication settings
  3. Open the Sign-in Method tab
  4. Enable the required sign-in provider
firebase — error
Navigate to https://console.firebase.google.com and click on your project from the dashboard.
auth/operation-not-allowed

What this error means

The auth/operation-not-allowed error indicates that the authentication provider you are trying to use has not been enabled in your Firebase project configuration. Firebase requires you to explicitly enable each sign-in method (Email/Password, Google, Anonymous, Phone, etc.) before your application can use it. When disabled, any attempt to authenticate users through that provider will fail with this error code. This is a security measure designed to prevent unauthorized authentication methods and ensure that your project only uses approved sign-in providers. The error acts as a gate between your application code and Firebase's authentication service.

Typical symptoms

  • Authentication requests fail immediately with code "auth/operation-not-allowed"
  • signInWithEmailAndPassword, createUserWithEmailAndPassword, or other auth methods throw the error
  • Anonymous sign-in attempts fail when trying to link accounts
  • Email linking operations fail for existing users
  • Error message displays: "This operation is not allowed. You must enable this service in the console."
  • Phone authentication fails even though SMS setup appears complete

Common causes

  1. The required sign-in provider is disabled in Firebase Console Authentication settings
  2. Email/Password provider not enabled when using email-based authentication
  3. Anonymous authentication disabled when attempting anonymous sign-in or linking
  4. Phone authentication disabled in Sign-in Method tab despite being configured in code
  5. New authentication method added to code but not enabled in Firebase Console
  6. Email Enumeration Protection enabled when using updateEmail() (deprecated method)
  7. Provider conflict when user exists under one authentication method but code attempts another

How to fix "auth/operation-not-allowed"

1Open Firebase Console and select your project
javascript
Navigate to https://console.firebase.google.com and click on your project from the dashboard.
2Go to Authentication settings

In the left sidebar, locate and click on "Authentication" under the "Build" section. If you don't see it, expand the "Build" menu.

3Open the Sign-in Method tab

At the top of the Authentication page, click on the "Sign-in method" tab. You will see a list of all available authentication providers.

4Enable the required sign-in provider

Find the authentication provider you need (Email/Password, Google, Anonymous, Phone, etc.) in the list. Click on it to expand the settings, then toggle the "Enable" switch to ON. Click "Save" to apply the changes.

5Verify provider is enabled

After saving, the provider should show a blue checkmark and "Enabled" status. If you changed multiple providers, enable each one you need for your application.

6Test your authentication code

Deploy or reload your application and test the authentication method that previously failed. The error should no longer occur. For example, if fixing email/password auth:

javascript
const auth = getAuth();
try {
  const userCredential = await createUserWithEmailAndPassword(auth, email, password);
  console.log("User created successfully");
} catch (error) {
  console.log("Error code:", error.code); // Should no longer be "auth/operation-not-allowed"
}

Advanced notes

For phone authentication specifically, also check the SMS region restrictions under Authentication > Settings tab. You may need to "Start with Allow" if you want to allow SMS in all regions or select specific regions.

If using email linking (linkWithCredential) and the error persists after enabling Email/Password, verify that both authentication methods exist under the same email address account. Users initially created with one provider cannot be linked with a conflicting provider.

Note: The updateEmail() method may throw "auth/operation-not-allowed" when Email Enumeration Protection is enabled. This method is now deprecated - use verifyBeforeUpdateEmail() instead.

For anonymous users attempting to link with an email provider, ensure both Anonymous and Email/Password are enabled. The linking process requires both providers to be active.

Frequently asked questions

What does "auth/operation-not-allowed" mean?
The auth/operation-not-allowed error indicates that the authentication provider you are trying to use has not been enabled in your Firebase project configuration. ) before your application can use it. When disabled, any attempt to authenticate users through that provider will fail with this error code.
How do I fix "auth/operation-not-allowed"?
The "auth/operation-not-allowed" error occurs when a sign-in provider is disabled in your Firebase project. Enable the required authentication method in the Firebase console Sign-in Method tab to resolve this issue.
What causes "auth/operation-not-allowed"?
The required sign-in provider is disabled in Firebase Console Authentication settings Email/Password provider not enabled when using email-based authentication Anonymous authentication disabled when attempting anonymous sign-in or linking
Is the "auth/operation-not-allowed" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading