Firebase Google sign-in for apps on Cloud Run

Why sign-in fails or shows firebaseapp.com on Cloud Run

• A new hostname Firebase doesn't know. Cloud Run gives each service a generated URL such as https://helloworld-RANDOM_HASH-us-central1.a.run.app. Firebase only runs OAuth sign-in on domains in its authorized list.
• The sign-in helper lives on another domain. By default authDomain is <project-id>.firebaseapp.com. Firebase's docs say Google may then show Continue to: https://<project-id>.firebaseapp.com. They also say signInWithRedirect() needs a fix on browsers that block third-party storage access (Chrome M115+, Firefox 109+, Safari 16.1+) when you host anywhere other than Firebase Hosting.
• Your /__/auth/ setup depends on how you add a custom domain. Google's Cloud Run docs list three ways: a global external Application Load Balancer (recommended), Cloud Run domain mapping (limited availability, Preview), or Firebase Hosting.

Choose your domain setup (as of Oct 2026)

Step 1: Add your hostnames to Firebase authorized domains

As of Oct 2026, Firebase's docs give Security > Authentication > Settings > Authorized domains > Add domain. Older guides use Build > Authentication > Settings. Add the hostname exactly as users load it, for example:

helloworld-RANDOM_HASH-us-central1.a.run.app
app.example.com

The first line uses the placeholder format from Firebase's Cloud Run guide. Copy your real run.app hostname from the Cloud Run console or from the output of gcloud run deploy. For more on the list itself, see Firebase authorized domains.

Option A: Firebase Hosting in front of Cloud Run

This is the shortest route to your own domain at sign-in. Firebase Hosting reserves /__/* paths, and those come first in Hosting's response order, ahead of rewrites. So /__/auth/handler keeps working even when every other path goes to Cloud Run.

1. In a folder separate from your service's source, create firebase.json. public is the one required Hosting field, so create an empty public folder next to it.

json { "hosting": { "public": "public", "rewrites": [ { "source": "**", "run": { "serviceId": "my-service", "region": "us-central1", "pinTag": true } } ] } }

region defaults to us-central1 if you leave it out. pinTag is optional: it pins each Hosting release to the Cloud Run revision that was live when you deployed.

2. Deploy: firebase deploy --only hosting --project YOUR_PROJECT_ID.
3. Connect your custom domain to Hosting. The full DNS, verification and SSL steps are in Firebase Hosting custom domain for auth.
4. Continue with Steps 2 and 3 below.

Know the limits before you switch:

• Firebase Hosting has a 60-second request timeout. Longer requests get a 504.
• Hosting strips cookies on requests to Cloud Run, except one named __session. If your server reads a session cookie, it has to be called __session.
• Your service must be in a region that supports Hosting rewrites (for example us-central1, europe-west1 or asia-east1; the full list is in Firebase's Cloud Run guide).

Option B or C: forward /__/auth/ from your Cloud Run app

With a load balancer or domain mapping, requests for /__/auth/ reach your container, so your app has to forward them to Firebase. Firebase's docs say the forwarding must be invisible to the browser and "cannot be done via a 302 Redirect".

Node.js (Express) with http-proxy-middleware:

import express from "express";
import { createProxyMiddleware } from "http-proxy-middleware";

const app = express();

// Register this BEFORE any body-parsing middleware (express.json(), etc.).
app.use(
  "/__/auth",
  createProxyMiddleware({
    target: "https://your-project-id.firebaseapp.com/__/auth",
    changeOrigin: true, // send Host: your-project-id.firebaseapp.com
  })
);

// ...your routes
app.listen(process.env.PORT || 8080);

This follows the library's "keep the same base path" pattern, so /__/auth/handler on your domain goes to /__/auth/handler on firebaseapp.com. If a body parser has to run first, the library's fixRequestBody helper fixes POST bodies that were already read.

Test this on a preview deployment before relying on it.

nginx in your container: Firebase's own example is:

location /__/auth {
  proxy_pass https://<project>.firebaseapp.com;
}

Cloud Run domain mapping commands (Preview):

gcloud beta run domain-mappings create --service SERVICE --domain app.example.com
gcloud beta run domain-mappings describe --domain app.example.com

Add every record listed under resourceRecords at your DNS provider. Google says the certificate usually takes about 15 minutes but can take up to 24 hours. If your DNS is behind Cloudflare's CDN, Google's docs say to turn off Always Use HTTPS under SSL/TLS > Edge Certificates, or the mapping can fail to validate.

Step 2: Add the redirect URI

As of Oct 2026, open Google Auth Platform > Clients in the Google Cloud console (older guides say Credentials), choose the web client created for your Firebase project, and add:

https://app.example.com/__/auth/handler

Changes can take 5 minutes to a few hours to apply.

Step 3: Set authDomain and rebuild

const firebaseConfig = {
  apiKey: "...",
  authDomain: "app.example.com", // was "your-project-id.firebaseapp.com"
  projectId: "your-project-id",
  appId: "...",
};

Next.js on Cloud Run: NEXT_PUBLIC_ variables are written into the browser bundle when next build runs. Changing them later as Cloud Run environment variables won't update client code. Set NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN (or whatever you call it) at build time, then rebuild the image. For the full Next.js sign-in setup, see Next.js Firebase Google sign-in.

Check Firebase ID tokens on your Cloud Run server

Sign-in happens in the browser. Your server should identify the user by checking their Firebase ID token, which the client sends over HTTPS.

Client (send the token):

import { getAuth } from "firebase/auth";

// currentUser is null until sign-in has finished.
const token = await getAuth().currentUser.getIdToken();
const res = await fetch("/api/me", {
  headers: { Authorization: `Bearer ${token}` },
});

Server (Node.js Admin SDK):

import { initializeApp } from "firebase-admin/app";
import { getAuth } from "firebase-admin/auth";

initializeApp(); // on Cloud Run, picks up Application Default Credentials

app.get("/api/me", async (req, res) => {
  const match = /^Bearer (.+)$/.exec(req.headers.authorization || "");
  if (!match) return res.status(401).json({ error: "missing token" });
  try {
    const decoded = await getAuth().verifyIdToken(match[1]);
    res.json({ uid: decoded.uid });
  } catch {
    res.status(401).json({ error: "invalid token" });
  }
});

Firebase recommends Application Default Credentials for apps on Cloud Run, so you don't ship a key file. verifyIdToken() checks the token's format, expiry and signature, but by itself it doesn't check whether the token was revoked (see Firebase's "Detect ID token revocation").

How to confirm it worked

1. Open https://app.example.com/__/auth/handler. The address bar should stay on your domain (no 302 to firebaseapp.com), and the response shouldn't be your app's own 404.
2. Sign in. Google's account chooser should show your domain instead of <project-id>.firebaseapp.com (why Google says "continue to firebaseapp.com").
3. Call /api/me after signing in. It should return your uid. Without the header it should return 401.

Related problems

• Redirect returns to your app with no user: signInWithRedirect not working.
• auth/unauthorized-domain on one hostname but not another (for example on the run.app URL when you only added your custom domain): each hostname is its own entry in the list, so add it as in Step 1.
• Error 400: redirect_uri_mismatch after switching authDomain: the Step 2 URI is missing or hasn't taken effect yet.