How to fix auth/unauthorized-continue-uri: Continue URL domain not whitelisted in Firebase
Firebase rejects continue URLs that point to domains outside Authentication → Settings → Authorized Domains, so email-action or redirect flows fail with auth/unauthorized-continue-uri. Whitelist the domain and make sure ActionCodeSettings.url uses that host before sending links.
Quick fix
Fixes auth/unauthorized-continue-uri: Continue URL domain not whitelisted
const actionCodeSettings = {
url: 'https://app.example.com/auth/email-link-complete',
handleCodeInApp: true
};
await sendSignInLinkToEmail(auth, email, actionCodeSettings).catch((error) => {
console.error('Firebase error:', error.code, error.message);
});- Confirm the continue URL host you are sending
- Add the hostname to Firebase’s authorized domains
- Whitelist any custom dynamic link or hosting domains you use
- Retry the flow and watch for the error to disappear
const actionCodeSettings = {url: 'https://app.example.com/auth/email-link-complete',handleCodeInApp: true};await sendSignInLinkToEmail(auth, email, actionCodeSettings).catch((error) => {console.error('Firebase error:', error.code, error.message);});auth/unauthorized-continue-uri: Continue URL domain not whitelisted
What this error means
Firebase evaluates continue/redirect URLs (ActionCodeSettings.url) against your project's Authorized Domains list before issuing password reset, email verification, email sign-in, or OAuth redirect links. If the hostname is missing from that list, Firebase blocks the request to prevent open redirect abuse and surfaces auth/unauthorized-continue-uri before the link is even sent. This usually happens when you plug in a new custom domain, deep subdomain, Firebase Dynamic Links host, or localhost address that hasn't been added to Authentication → Settings. When the continue URL fails this whitelist, the backend reports the domain as "not whitelisted" even though the rest of the request is valid. Firebase uses the exact hostname to match the configured list, so changing the hostname or using a previously unseen redirect host triggers this error until that host is explicitly authorized.
Typical symptoms
- sendSignInLinkToEmail(), sendPasswordResetEmail(), signInWithRedirect(), or Admin SDK generate*Link calls throw auth/unauthorized-continue-uri before sending the email or redirect.
- Firebase console logs display “Continue URL domain not whitelisted” and the email action never completes.
- Users click the emailed link and land on Firebase’s error page instead of your app, even though the link itself loads.
- CI/integration flows that exercise email links fail immediately with the unauthorized host error.
Common causes
- The continue URL's hostname hasn’t been added to Authentication → Settings → Authorized domains, so Firebase refuses the action link.
- The URL uses a deeper subdomain (app.example.com, auth.example.com) that isn’t listed even though the parent domain is present.
- You are redirecting through a Firebase Dynamic Links host or custom hosting domain and never whitelisted that host.
- Developing on localhost but forgot to explicitly add localhost to the Authorized domains list (new projects no longer include it by default).
- ActionCodeSettings.url is computed at runtime and resolves to an unexpected host (staging, preview, or vanity domain) that is missing from the whitelist.
How to fix "auth/unauthorized-continue-uri: Continue URL domain not whitelisted"
Log the ActionCodeSettings.url that you pass to Firebase and make sure it matches the host you want to trust:
const actionCodeSettings = {
url: 'https://app.example.com/auth/email-link-complete',
handleCodeInApp: true
};
await sendSignInLinkToEmail(auth, email, actionCodeSettings).catch((error) => {
console.error('Firebase error:', error.code, error.message);
});If the logged host is different from the domain you see in the browser, update the URL builder so the domain matches the one you are about to authorize.
1. Open Firebase Console → Authentication → Settings.
2. Scroll to “Authorized domains” and click “Add domain”.
3. Enter the hostname from your continue URL, for example app.example.com, project-id.firebaseapp.com, or auth.example.page.link.
4. Click Save.
Only the hostname matters—paths and query strings are ignored—so make sure you add the exact host that appears in ActionCodeSettings.url.
If you serve the continue route through Firebase Hosting, a Dynamic Links domain, or a custom redirect like yourapp.page.link, add that host as well. Firebase treats each host separately, so adding example.com does not cover subdomain.example.com or project-id.page.link. After updating the list, redeploy or restart the service so the new domain propagates.
Reinvoke the email-action or redirect call and confirm it now resolves:
try {
await signInWithEmailLink(auth, email, actionCodeSettings);
console.log('Link sent or handled successfully');
} catch (error) {
console.error('Still failing:', error.code, error.message);
}If you still see auth/unauthorized-continue-uri, verify the console log again and compare the domain to the list in Firebase Console.
Advanced notes
Authorized domains act as a whitelist that protects Firebase action links from being redirected to arbitrary hosts. Firebase matches only the hostname, so you must add app.example.com, auth.example.com, or any Firebase Dynamic Links host exactly. Projects created after April 28, 2025 no longer include localhost automatically, so add it manually when debugging locally. Once the hostname is authorized, Firebase will allow the continue/redirect URL to flow while still rejecting unlisted hosts to prevent phishing and open redirect attacks.
Frequently asked questions
- What does "auth/unauthorized-continue-uri: Continue URL domain not whitelisted" mean?
- url) against your project's Authorized Domains list before issuing password reset, email verification, email sign-in, or OAuth redirect links. If the hostname is missing from that list, Firebase blocks the request to prevent open redirect abuse and surfaces auth/unauthorized-continue-uri before the link is even sent. This usually happens when you plug in a new custom domain, deep subdomain, Firebase Dynamic Links host, or localhost address that hasn't been added to Authentication → Settings.
- How do I fix "auth/unauthorized-continue-uri: Continue URL domain not whitelisted"?
- Firebase rejects continue URLs that point to domains outside Authentication → Settings → Authorized Domains, so email-action or redirect flows fail with auth/unauthorized-continue-uri. Whitelist the domain and make sure ActionCodeSettings.url uses that host before sending links.
- What causes "auth/unauthorized-continue-uri: Continue URL domain not whitelisted"?
- The continue URL's hostname hasn’t been added to Authentication → Settings → Authorized domains, so Firebase refuses the action link. The URL uses a deeper subdomain (app.example.com, auth.example.com) that isn’t listed even though the parent domain is present. You are redirecting through a Firebase Dynamic Links host or custom hosting domain and never whitelisted that host.
- Is the "auth/unauthorized-continue-uri: Continue URL domain not whitelisted" error serious?
- It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.