Fix guides / Firebase: "auth/invalid-api-key"

How to fix Firebase "auth/invalid-api-key"

Your app loads and immediately throws FirebaseError: Firebase: Error (auth/invalid-api-key) or auth/api-key-not-valid.-please-pass-a-valid-api-key. Nine times out of ten the key is not wrong. It is undefined.

Why it happens

  • The config reads env vars that are not available in the browser build: wrong prefix (Vite needs VITE_, Next.js needs NEXT_PUBLIC_), or not set on the host.
  • The config was copied from a different Firebase project or an old web app that was deleted.
  • The key has application restrictions in Google Cloud that do not include your live domain, or API restrictions that leave out Identity Toolkit.

Fix 1: confirm what the app actually receives

console.log('firebase key present:', !!import.meta.env.VITE_FIREBASE_API_KEY);

If it logs false in production, add the variables to your host with the right prefix and redeploy.

Fix 2: copy a fresh config

In the Firebase console open Project settings, General, Your apps, choose the web app, and copy the whole firebaseConfig object. All values must come from the same project.

Fix 3: check key restrictions

In Google Cloud Console, APIs and Services, Credentials, open the browser key. If it is restricted to HTTP referrers, add https://yourdomain.com/* and your preview domains. If API restrictions are on, include Identity Toolkit API and the other Firebase APIs you use.

Is it safe that the key is public?

Yes. A Firebase web API key identifies the project and is meant to be in the browser. Your data is protected by security rules, so make sure those are set (see the Firestore permissions guide).

Check the fix

  1. Hard refresh the live site; the error is gone.
  2. Sign in works. If it now says auth/unauthorized-domain, see that guide.
Still stuck? No shame in it: these bugs hide in places your AI builder cannot see. Send me the error and your repo and I will fix it as a pull request within 24 hours, explained in plain English, for $49. Several things broken? The $149 Full Rescue covers up to 3 issues plus a security pass, within 72 hours. Not fixed means full refund.
Quick Fix, $49Full Rescue, $149Ask first

Last updated 2026-10-21.