How to fix auth/too-many-requests in Firebase

async function authWithBackoff(authFunction, maxRetries = 3) {
  for (let i = 0; i < maxRetries; i++) {
    try {
      return await authFunction();
    } catch (error) {
      if (error.code === 'auth/too-many-requests' && i < maxRetries - 1) {
        // Exponential backoff: 1s, 2s, 4s, 8s...
        const delayMs = Math.pow(2, i) * 1000;
        await new Promise(resolve => setTimeout(resolve, delayMs));
      } else {
        throw error;
      }
    }
  }
}

// Usage
authWithBackoff(() => auth.signInWithEmailAndPassword(email, password));

import { initializeAppCheck, ReCaptchaV3Provider } from 'firebase/app-check';

// Initialize App Check with reCAPTCHA v3
initializeAppCheck(app, {
  provider: new ReCaptchaV3Provider('YOUR_RECAPTCHA_PUBLIC_KEY'),
  isTokenAutoRefreshEnabled: true,
});

// Or for sign-in with reCAPTCHA v2
const recaptchaVerifier = new firebase.auth.RecaptchaVerifier('recaptcha-container');

auth.signInWithPhoneNumber(phoneNumber, recaptchaVerifier)
  .then(confirmationResult => {
    // Handle confirmation
  })
  .catch(error => {
    if (error.code === 'auth/too-many-requests') {
      // User will see reCAPTCHA on next attempt
    }
  });

// For phone authentication testing, use non-production phone numbers
const testPhoneNumbers = [
  '+11234567890',
  '+15555555555',
];

// For email testing, use different test accounts each time
const testEmails = [
  '[email protected]',
  '[email protected]',
];

// This prevents hitting rate limits during development

// Implement minimum delay between auth operations
class AuthRateLimiter {
  constructor(minDelayMs = 2000) {
    this.minDelayMs = minDelayMs;
    this.lastRequestTime = 0;
  }

  async executeAuthOperation(operation) {
    const timeSinceLastRequest = Date.now() - this.lastRequestTime;
    if (timeSinceLastRequest < this.minDelayMs) {
      await new Promise(resolve =>
        setTimeout(resolve, this.minDelayMs - timeSinceLastRequest)
      );
    }
    this.lastRequestTime = Date.now();
    return operation();
  }
}

const limiter = new AuthRateLimiter(3000); // 3 second minimum between requests
limiter.executeAuthOperation(() => sendPasswordResetEmail(email));

// Log auth attempts to identify patterns
async function logAuthAttempt(operation, email) {
  const timestamp = new Date().toISOString();
  console.log(`[${timestamp}] Auth operation: ${operation} - ${email}`);

  try {
    const result = await performAuthOperation();
    console.log('SUCCESS');
    return result;
  } catch (error) {
    if (error.code === 'auth/too-many-requests') {
      console.warn('RATE_LIMITED - Wait before retrying');
    }
    throw error;
  }
}

// Review logs to see if specific operations (sendEmailVerification, signUp, etc.)
// are triggering limits more frequently