Fixing Firebase Google sign-in in Lovable, Bolt and Cursor apps

First, check that your app really uses Firebase

Neither Lovable nor Bolt defaults to Firebase, so "Google login" may have been wired to something else:

• Lovable: its built-in backend (called Cloud in parts of the product) includes authentication and "utilizes Supabase's open-source foundation." Lovable's managed Google sign-in only works with that built-in backend; for anything else, its docs say Google auth "requires a manual setup outside of Lovable."
• Bolt.new: Bolt Cloud creates a Bolt Database automatically when a project needs one, and its docs note user authentication "may not be added automatically." Supabase is an option you choose when starting a new project on Pro or Teams plans.
• Cursor: it's an editor; it uses whatever stack your code uses.

Search the code for firebase/auth. If you find initializeApp, getAuth and signInWithPopup or signInWithRedirect from firebase/auth, this page applies. If sign-in goes through the builder's own backend instead, fix it in that backend's settings, not in Firebase.

Why Firebase Google sign-in fails in AI-built apps

1. The host isn't authorized. Firebase only allows OAuth from domains on your project's Authorized domains list, and errors with auth/unauthorized-domain otherwise. Builder apps run on several hosts: an editor preview, a shareable preview link, the published address (your-app.lovable.app, *.bolt.host) and any custom domain. With Cursor, the app runs on localhost, which projects created after April 28, 2025 no longer authorize by default.
2. The Google provider is off. The AI can write sign-in code but can't flip console switches. Result: auth/operation-not-allowed ("The given sign-in provider is disabled for this Firebase project").
3. Placeholder or mismatched config. "YOUR_API_KEY" left in, or values copied from a different Firebase project, gives auth/invalid-api-key or sign-ins landing in the wrong project.
4. Popups inside an embedded preview. If a preview is shown in a sandboxed iframe without allow-popups, window.open() fails silently, so clicking the button appears to do nothing.
5. Redirect flow on a non-Firebase host. If the AI chose signInWithRedirect(), Firebase's redirect best practices say apps not served from firebaseapp.com need extra setup on Chrome M115+, Firefox 109+ and Safari 16.1+. On builder hosts, signInWithPopup() is the simpler choice (popup or redirect?).

Step-by-step fix

1. Collect every host your app runs on

Copy the host only: no https://, no port, no path.

2. Configure Firebase

1. Firebase console > Security > Authentication (older guides: Build > Authentication; the Firebase docs say Security as of Oct 2026) > Sign-in method > enable Google > Save.
2. Same page > Settings tab > Authorized domains > Add domain for each host from step 1.
3. Project settings > Your apps > copy the web app's config object.

Firebase's web config is not a secret; Firebase says API keys for Firebase services are OK to include in code. If your project uses Vite (look for a vite.config.* file), only VITE_-prefixed environment variables reach browser code, and they're baked in at build time.

3. Use a minimal, current sign-in module

// src/lib/firebase.js
import { initializeApp } from 'firebase/app';
import { getAuth, GoogleAuthProvider, signInWithPopup, signOut, onAuthStateChanged } from 'firebase/auth';

const firebaseConfig = {
  apiKey: '...',
  authDomain: 'YOUR-PROJECT.firebaseapp.com', // keep the default
  projectId: 'YOUR-PROJECT',
  appId: '...',
};

export const app = initializeApp(firebaseConfig);
export const auth = getAuth(app);

export async function signInWithGoogle() {
  try {
    const result = await signInWithPopup(auth, new GoogleAuthProvider());
    return result.user;
  } catch (error) {
    console.error(error.code, error.message); // e.g. auth/unauthorized-domain
    throw error;
  }
}

export const signOutUser = () => signOut(auth);
export const watchUser = (callback) => onAuthStateChanged(auth, callback);

Call signInWithGoogle() directly from the button's click handler. A popup has to be triggered from a UI event handler, and that user activation expires after a timeout, so don't put slow awaited work in front of it.

4. Test outside the editor

Open the preview in its own tab (or open the published URL), click the button, pick an account. Fix any error code you see before asking the AI for more changes.

5. Paste this prompt into Lovable, Bolt or Cursor

Fix Google sign-in in this app. Requirements:
1. Use Firebase Authentication with the modular Firebase JS SDK (v9+ syntax: imports from "firebase/app" and "firebase/auth"). Do not switch to another auth provider or backend.
2. Initialize Firebase exactly once in a single module (e.g. src/lib/firebase.*) and export `auth`. Remove any duplicate initializeApp calls.
3. Use this config and keep authDomain as "<YOUR-PROJECT>.firebaseapp.com": <PASTE CONFIG OBJECT HERE>
4. Sign in with signInWithPopup(auth, new GoogleAuthProvider()) called directly inside the button's click handler. Do not use signInWithRedirect.
5. Track the user with onAuthStateChanged and show signed-in / signed-out UI from it.
6. In the catch block, log error.code and show a short message in the UI. Do not swallow errors.
7. Do not change anything in the Firebase console and do not invent environment variables; if a value is missing, ask me.
After the change, list the files you edited.

For Cursor, you can save the same rules as a project rule in .cursor/rules/firebase-auth.mdc (or in AGENTS.md) so later edits keep them. Firebase also publishes an MCP server and a Cursor Marketplace plugin; its firebase_get_sdk_config tool returns your registered app's config, which avoids copy-paste mistakes.

How to confirm it worked

1. The Google account chooser opens in a popup, closes after you pick an account, and your UI switches to signed in.
2. Reload: onAuthStateChanged reports the same user without another sign-in.
3. In the Firebase console, your Google account appears on the Authentication Users tab.
4. Repeat on the published URL and each custom domain.

Related problems

• Works on the published site but not on localhost in Cursor: auth/unauthorized-domain on localhost
• Popup errors: auth/popup-blocked
• Domain is on the list and it still fails: authorized domains not working
• Hand-building the same thing in Vite + React: Vite React Firebase Google sign-in