FirebaseAuth

public abstract class FirebaseAuth

---

The entry point of the Firebase Authentication SDK.

First, obtain an instance of this class by calling getInstance.

Then, sign up or sign in a user with one of the following methods:

• createUserWithEmailAndPassword
• signInWithEmailAndPassword
• signInWithCredential
• signInAnonymously
• signInWithCustomToken

Finally, call getCurrentUser to get a FirebaseUser object, which contains information about the signed-in user.

Summary

Nested types
public interface FirebaseAuth.AuthStateListener Listener called when there is a change in the authentication state.
public interface FirebaseAuth.IdTokenListener Listener called when the id token is changed.

Public fields
@Nullable FirebaseUser	currentUser
String	customAuthDomain
String	languageCode
String	tenantId

Public methods
void	addAuthStateListener(@NonNull FirebaseAuth.AuthStateListener listener) Registers a listener to changes in the user authentication state.
void	addIdTokenListener(@NonNull FirebaseAuth.IdTokenListener listener) Registers a listener to changes in the token authentication state.
@NonNull Task<Void>	applyActionCode(@NonNull String code) Applies the given code, which can be any out of band code which is valid according to checkActionCode that does not also pass verifyPasswordResetCode, which requires an additional parameter.
@NonNull Task<ActionCodeResult>	checkActionCode(@NonNull String code) Checks that the code given is valid.
@NonNull Task<Void>	confirmPasswordReset(@NonNull String code, @NonNull String newPassword) Changes the user's password to newPassword for the account for which the code is valid.
@NonNull Task<AuthResult>	createUserWithEmailAndPassword(     @NonNull String email,     @NonNull String password ) Tries to create a new user account with the given email address and password.
@NonNull Task<SignInMethodQueryResult>	fetchSignInMethodsForEmail(@NonNull String email) This method is deprecated. Migrating off of this method is recommended as a security best-practice.
@NonNull FirebaseApp	getApp() Returns the FirebaseApp instance to which this FirebaseAuth belongs.
@Nullable FirebaseUser	getCurrentUser() Returns the currently signed-in FirebaseUser or null if there is none.
@Nullable String	getCustomAuthDomain() Returns the custom auth domain previously set on this instance or null if none was set.
@NonNull FirebaseAuthSettings	getFirebaseAuthSettings() Returns the FirebaseAuthSettings instance for this FirebaseAuth instance.
static @NonNull FirebaseAuth	@Keep getInstance() Returns an instance of this class corresponding to the default FirebaseApp instance.
static @NonNull FirebaseAuth	@Keep getInstance(@NonNull FirebaseApp firebaseApp) Returns an instance of this class corresponding to the given FirebaseApp instance.
@Nullable String	getLanguageCode() Returns the language code set in setLanguageCode.
@Nullable Task<AuthResult>	getPendingAuthResult() Returns a Task wrapping an AuthResult.
@Nullable String	getTenantId() Returns the Tenant ID previously set on this instance or null if none was set.
@NonNull Task<Void>	initializeRecaptchaConfig() Initializes the reCAPTCHA Enterprise client proactively to enhance reCAPTCHA signal collection and to complete reCAPTCHA-protected flows in a single attempt.
boolean	isSignInWithEmailLink(@NonNull String link) Determines if the given link is a link intended for use with getCredentialWithLink.
void	removeAuthStateListener(     @NonNull FirebaseAuth.AuthStateListener listener ) Unregisters a listener to authentication changes.
void	removeIdTokenListener(@NonNull FirebaseAuth.IdTokenListener listener) Unregisters a listener to authentication changes.
@NonNull Task<Void>	revokeAccessToken(@NonNull String accessToken) Revokes the provided accessToken.
@NonNull Task<Void>	sendPasswordResetEmail(@NonNull String email) Calls sendPasswordResetEmail without any ActionCodeSettings.
@NonNull Task<Void>	sendPasswordResetEmail(     @NonNull String email,     @Nullable ActionCodeSettings actionCodeSettings ) Triggers the Firebase Authentication backend to send a password-reset email to the given email address, which must correspond to an existing user of your app.
@NonNull Task<Void>	sendSignInLinkToEmail(     @NonNull String email,     @NonNull ActionCodeSettings actionCodeSettings ) Sends an email to the specified email which will contain a link to be used to sign in the user.
void	setCustomAuthDomain(@NonNull String domain) Sets the custom auth domain that is used to handle all sign-in redirects.
@NonNull Task<Void>	setFirebaseUIVersion(@Nullable String firebaseUIVersion) For internal use in FirebaseUI only.
void	setLanguageCode(@NonNull String languageCode) Sets the user-facing language code for auth operations that can be internationalized, such as sendEmailVerification.
void	setTenantId(@NonNull String tenantId) Sets the Tenant ID to be passed on all future sign-in/sign-up operations and sign in or sign up users to the specified project as identified by the tenant.
@NonNull Task<AuthResult>	signInAnonymously() Signs in the user anonymously without requiring any credential.
@NonNull Task<AuthResult>	signInWithCredential(@NonNull AuthCredential credential) Tries to sign in a user with the given AuthCredential.
@NonNull Task<AuthResult>	signInWithCustomToken(@NonNull String token) Tries to sign in a user with a given Custom Token.
@NonNull Task<AuthResult>	signInWithEmailAndPassword(@NonNull String email, @NonNull String password) Tries to sign in a user with the given email address and password.
@NonNull Task<AuthResult>	signInWithEmailLink(@NonNull String email, @NonNull String link) Tries to sign in a user with the given email address and link.
void	signOut() Signs out the current user and clears it from the disk cache.
@NonNull Task<AuthResult>	startActivityForSignInWithProvider(     @NonNull Activity activity,     @NonNull FederatedAuthProvider federatedAuthProvider ) Signs in the user using the mobile browser (either a Custom Chrome Tab or the device's default browser) for the given provider.
@NonNull Task<Void>	updateCurrentUser(@NonNull FirebaseUser user) Sets the current user to a copy of the given user, but associated with this 's FirebaseApp.
void	useAppLanguage() Sets the user-facing language code to be the default app language.
void	useEmulator(@NonNull String host, int port) Modifies this FirebaseAuth instance to communicate with the Firebase Authentication emulator.
@NonNull Task<String>	verifyPasswordResetCode(@NonNull String code) Checks that the code is a valid password reset out of band code.

Public fields

currentUser

public @Nullable FirebaseUser currentUser

customAuthDomain

public String customAuthDomain

languageCode

public String languageCode

tenantId

public String tenantId

Public methods

addAuthStateListener

public void addAuthStateListener(@NonNull FirebaseAuth.AuthStateListener listener)

Registers a listener to changes in the user authentication state. There can be more than one listener registered at the same time for one or more FirebaseAuth instances.

The listeners call back in the UI thread, on the following events:

• Right after the listener has been registered
• When a user signs in
• When the current user signs out
• When the current user changes

It is a recommended practice to always listen to sign-out events, as you may want to prompt the user to sign in again and maybe restrict the information or actions they have access to.

Use removeAuthStateListener to unregister a listener.

See addIdTokenListener if you want to listen to token refreshes.

See Also: AuthStateListener

addIdTokenListener

public void addIdTokenListener(@NonNull FirebaseAuth.IdTokenListener listener)

Registers a listener to changes in the token authentication state. There can be more than one listener registered at the same time for one or more FirebaseAuth instances.

The listeners call back in the UI thread, on the following events:

• Right after the listener has been registered
• When a user signs in
• When the current user signs out
• When the current user changes
• When there is a change in the current user's token

It is a recommended practice to always listen to sign-out events, as you may want to prompt the user to sign in again and maybe restrict the information or actions they have access to.

Use removeIdTokenListener to unregister a listener.

See addAuthStateListener if you do not want to listen to token refreshes.

See Also: IdTokenListener

applyActionCode

public @NonNull Task<Void> applyActionCode(@NonNull String code)

Applies the given code, which can be any out of band code which is valid according to checkActionCode that does not also pass verifyPasswordResetCode, which requires an additional parameter.

checkActionCode

public @NonNull Task<ActionCodeResult> checkActionCode(@NonNull String code)

Checks that the code given is valid. This code will have been generated by sendPasswordResetEmail or sendEmailVerification valid for a single use.

Returns
@NonNull Task<ActionCodeResult>	Task which you can use to see the result via the ActionCodeResult, which holds the user email for which that ActionCode is valid, as well as the which is being performed.

confirmPasswordReset

public @NonNull Task<Void> confirmPasswordReset(@NonNull String code, @NonNull String newPassword)

Changes the user's password to newPassword for the account for which the code is valid. Code validity can be checked with verifyPasswordResetCode. This use case is only valid for signed-out users, and behavior is undefined for signed-in users. Password changes for signed-in users should be made using updatePassword.

Exceptions

• IllegalArgumentException thrown if passed a null code or newPassword
• FirebaseAuthActionCodeException thrown if the code is malformed or has expired.
• FirebaseAuthInvalidUserException thrown if the user corresponding to the given code has been disabled, or if there is no user corresponding to the given code.
• FirebaseAuthWeakPasswordException thrown if the given newPassword is too weak.

See Also:

• verifyPasswordResetCode
• sendPasswordResetEmail

createUserWithEmailAndPassword

public @NonNull Task<AuthResult> createUserWithEmailAndPassword(
    @NonNull String email,
    @NonNull String password
)

Tries to create a new user account with the given email address and password. If successful, it also signs the user in into the app.

Access the signed-in user with getCurrentUser.

Upon successful completion, this operation triggers an onIdTokenChanged event in all registered s and an onAuthStateChanged event in all registered AuthStateListeners.

Important: you must enable Email &Password accounts in the Firebase console before you can use this method.

Exceptions

• FirebaseAuthWeakPasswordException thrown if the password is not strong enough
• FirebaseAuthInvalidCredentialsException thrown if the email address is malformed
• FirebaseAuthUserCollisionException thrown if there already exists an account with the given email address

See Also:

• signInWithEmailAndPassword
• signInWithCredential
• signInAnonymously
• signInWithCustomToken

Returns
@NonNull Task<AuthResult>	Task of AuthResult with the result of the operation

fetchSignInMethodsForEmail

public @NonNull Task<SignInMethodQueryResult> fetchSignInMethodsForEmail(@NonNull String email)

This method is deprecated.

Migrating off of this method is recommended as a security best-practice. Learn more in the Identity Platform documentation for Email Enumeration Protection.

Returns a list of signin methods that can be used to sign in a given user (identified by its main email address). This will match the getSignInMethod for the credential you would generate for the appropriate signin mechanism.

This method is useful when you support multiple authentication mechanisms if you want to implement an email-first authentication flow. It is also useful to resolve a thrown on signInWithCredential.

Exceptions

• FirebaseAuthInvalidCredentialsException thrown if the email address is malformed

Parameters
@NonNull String email	the email address that identifies the user to fetch the providers from

Returns
@NonNull Task<SignInMethodQueryResult>	Task of SignInMethodQueryResult with the result of the operation. An empty list is returned when Email Enumeration Protection is enabled, irrespective of the number of authentication methods available for the given email.

getApp

public @NonNull FirebaseApp getApp()

Returns the FirebaseApp instance to which this FirebaseAuth belongs.

getCurrentUser

public @Nullable FirebaseUser getCurrentUser()

Returns the currently signed-in FirebaseUser or null if there is none.

Use getCurrentUser() != null to check if a user is signed in.

Returns
@Nullable FirebaseUser	the signed-in user or null

getCustomAuthDomain

public @Nullable String getCustomAuthDomain()

Returns the custom auth domain previously set on this instance or null if none was set.

getFirebaseAuthSettings

public @NonNull FirebaseAuthSettings getFirebaseAuthSettings()

Returns the FirebaseAuthSettings instance for this FirebaseAuth instance.

getInstance

@Keep
public static @NonNull FirebaseAuth getInstance()

Returns an instance of this class corresponding to the default FirebaseApp instance.

Note: Firebase Authentication does not currently support Android Direct Boot.

For Applications that use Direct Boot, check if android.content.Context.isDeviceProtectedStorage is false before you call FirebaseAuth.getInstance().

getInstance

@Keep
public static @NonNull FirebaseAuth getInstance(@NonNull FirebaseApp firebaseApp)

Returns an instance of this class corresponding to the given FirebaseApp instance.

Note: Firebase Authentication does not currently support Android Direct Boot.

For Applications that use Direct Boot, check if android.content.Context.isDeviceProtectedStorage is false before you call FirebaseAuth.getInstance(firebaseApp).

getLanguageCode

public @Nullable String getLanguageCode()

Returns the language code set in setLanguageCode.

getPendingAuthResult

public @Nullable Task<AuthResult> getPendingAuthResult()

Returns a Task wrapping an AuthResult. This will return a non-null value if your app launches a web sign-in flow and the OS cleans up your hosting Activity while in the background (likely due to a low-memory event). The returned result is the value that startActivityForSignInWithProvider would have returned, which includes any Exceptions thrown. Otherwise, returns null.

This method will only return a non-null result for a sign-in once. A non-null value will only be present for suitably recent sign-ins to help prevent false positive sign-ins.

getTenantId

public @Nullable String getTenantId()

Returns the Tenant ID previously set on this instance or null if none was set.

initializeRecaptchaConfig

public @NonNull Task<Void> initializeRecaptchaConfig()

Initializes the reCAPTCHA Enterprise client proactively to enhance reCAPTCHA signal collection and to complete reCAPTCHA-protected flows in a single attempt.

Exceptions

• FirebaseAuthException thrown on initialization failures. Common reasons are:
  • running on an unsupported API version (< 19, KITKAT).
  • the reCAPTCHA config fetch API call failed.
  • network errors causing other API call/download failures.

Returns
@NonNull Task<Void>	Task indicating if initialization was successful.

isSignInWithEmailLink

public boolean isSignInWithEmailLink(@NonNull String link)

Determines if the given link is a link intended for use with getCredentialWithLink. These links are generated by sendSignInLinkToEmail.

removeAuthStateListener

public void removeAuthStateListener(
    @NonNull FirebaseAuth.AuthStateListener listener
)

Unregisters a listener to authentication changes.

See Also: AuthStateListener

removeIdTokenListener

public void removeIdTokenListener(@NonNull FirebaseAuth.IdTokenListener listener)

Unregisters a listener to authentication changes.

See Also: IdTokenListener

revokeAccessToken

public @NonNull Task<Void> revokeAccessToken(@NonNull String accessToken)

Revokes the provided accessToken. Currently supports revoking Apple-issued accessToken only.

sendPasswordResetEmail

public @NonNull Task<Void> sendPasswordResetEmail(@NonNull String email)

Calls sendPasswordResetEmail without any ActionCodeSettings.

sendPasswordResetEmail

public @NonNull Task<Void> sendPasswordResetEmail(
    @NonNull String email,
    @Nullable ActionCodeSettings actionCodeSettings
)

Triggers the Firebase Authentication backend to send a password-reset email to the given email address, which must correspond to an existing user of your app. Takes in an which allows linking back to your app from the sent email.

Exceptions

• FirebaseAuthInvalidUserException thrown if there is no user corresponding to the given email address
• No exception will be thrown in the above case, when Email Enumeration Protection is enabled.

Parameters
@NonNull String email	the email of the account to which you wish to issue an account reset email
@Nullable ActionCodeSettings actionCodeSettings	the settings used to allow your app to handle the link sent in the email on iOS, web, and Android.

Returns
@NonNull Task<Void>	Task to track completion of the sending operation

sendSignInLinkToEmail

public @NonNull Task<Void> sendSignInLinkToEmail(
    @NonNull String email,
    @NonNull ActionCodeSettings actionCodeSettings
)

Sends an email to the specified email which will contain a link to be used to sign in the user.

Throws
java.lang.IllegalArgumentException	when given an ActionCodeSettings that does not have canHandleCodeInApp set to true. See also getCredentialWithLink

setCustomAuthDomain

public void setCustomAuthDomain(@NonNull String domain)

Sets the custom auth domain that is used to handle all sign-in redirects. End-users will see this domain when signing in.

The domain must be allowlisted in the Firebase Console. If the domain contains a scheme ( https:// or http://) or trailing slashes, they will be stripped off.

setFirebaseUIVersion

public @NonNull Task<Void> setFirebaseUIVersion(@Nullable String firebaseUIVersion)

For internal use in FirebaseUI only.

setLanguageCode

public void setLanguageCode(@NonNull String languageCode)

Sets the user-facing language code for auth operations that can be internationalized, such as sendEmailVerification. This language code should follow the conventions defined by the IETF in BCP47.

setTenantId

public void setTenantId(@NonNull String tenantId)

Sets the Tenant ID to be passed on all future sign-in/sign-up operations and sign in or sign up users to the specified project as identified by the tenant. If you change this field, future sign-in/sign-ups will contain the new value.

This is set to null as default and users are signed into the agent project.

Note: this is different from what the current user's Tenant ID is; you can change this instance's Tenant ID without affecting the current user.

signInAnonymously

public @NonNull Task<AuthResult> signInAnonymously()

Signs in the user anonymously without requiring any credential.

This method creates a new account in your Firebase Authentication system, except in the case where there was already an anonymous user signed in into this app. Access the signed-in user with getCurrentUser.

Upon successful completion, this operation triggers an onIdTokenChanged event in all registered s and an onAuthStateChanged event in all registered AuthStateListeners.

Anonymous users do not require any credential, and are useful in situations where you want to persist information about your users before asking them to sign in. For example, they may be useful when implementing a signed-out shopping cart in an e-commerce application.

Due to the unauthenticated nature of this kind of user, they are not transferrable across devices. In order to allow your app's users to keep their information, ask them to provide some other authentication credentials, and link them to the current user with linkWithCredential.

Important: you must enable Anonymous accounts in the Firebase console before being able to use them.

• signInWithEmailAndPassword
• createUserWithEmailAndPassword
• signInWithCredential
• signInWithCustomToken

Returns
@NonNull Task<AuthResult>	Task of AuthResult with the result of the operation

signInWithCredential

public @NonNull Task<AuthResult> signInWithCredential(@NonNull AuthCredential credential)

Tries to sign in a user with the given AuthCredential.

Use this method to sign in a user into your Firebase Authentication system. First retrieve the credential either directly from the user, in case of EmailAuthCredential, or from a supported authentication SDK, such as Google Sign-In or Facebook. Later access the signed-in user with getCurrentUser.

For all AuthCredential types except EmailAuthCredential, this method will create an account for the user in the case that it didn't exist before.

Important: you must configure the authentication providers in the Firebase console before you can use them.

Exceptions

• FirebaseAuthInvalidUserException thrown if the user account you are trying to sign in to has been disabled. Also thrown if credential is an EmailAuthCredential with an email address that does not correspond to an existing user.
• FirebaseAuthInvalidCredentialsException thrown if the credential is malformed or has expired. If credential instanceof EmailAuthCredential it will be thrown if the password is incorrect.
• FirebaseAuthUserCollisionException thrown if there already exists an account with the email address asserted by the credential. Resolve this case by calling fetchSignInMethodsForEmail and then asking the user to sign in using one of them.

See Also:

• signInWithEmailAndPassword
• createUserWithEmailAndPassword
• signInAnonymously
• signInWithCustomToken

Returns
@NonNull Task<AuthResult>	Task of AuthResult with the result of the operation

signInWithCustomToken

public @NonNull Task<AuthResult> signInWithCustomToken(@NonNull String token)

Tries to sign in a user with a given Custom Token.

Use this method after you retrieve a Firebase Auth Custom Token from your server, to sign in a user into your Firebase Authentication system. Access the signed-in user with getCurrentUser.

Upon successful completion, this operation triggers an onIdTokenChanged event in all registered s and an onAuthStateChanged event in all registered AuthStateListeners.

This operation might create an account if the uid specified in the token corresponds to a user without a record in the system.

Read how to use Custom Token authentication and the cases where it is useful in the guides.

Exceptions

• FirebaseAuthInvalidCredentialsException thrown if the token format is incorrect or if it corresponds to a different Firebase App

• signInWithEmailAndPassword
• createUserWithEmailAndPassword
• signInWithCredential
• signInAnonymously

Returns
@NonNull Task<AuthResult>	Task of AuthResult with the result of the operation

signInWithEmailAndPassword

public @NonNull Task<AuthResult> signInWithEmailAndPassword(@NonNull String email, @NonNull String password)

Tries to sign in a user with the given email address and password.

Access the signed-in user with getCurrentUser.

Upon successful completion, this operation triggers an onIdTokenChanged event in all registered s and an onAuthStateChanged event in all registered AuthStateListeners.

This is equivalent to calling signInWithCredential with an generated by getCredential.

Important: you must enable Email &Password accounts in the Firebase console before being able to use this method.

Exceptions

• FirebaseAuthInvalidUserException thrown if the user account corresponding to email does not exist or has been disabled
• FirebaseAuthInvalidCredentialsException thrown if the password is wrong
• When Email Enumeration Protection is enabled, FirebaseAuthInvalidCredentialsException is thrown if the email or password is invalid.

See also:

• createUserWithEmailAndPassword
• signInWithCredential
• signInAnonymously
• signInWithCustomToken

Returns
@NonNull Task<AuthResult>	Task of AuthResult with the result of the operation

signInWithEmailLink

public @NonNull Task<AuthResult> signInWithEmailLink(@NonNull String email, @NonNull String link)

Tries to sign in a user with the given email address and link. This link should be generated by sendSignInLinkToEmail.

Access the signed-in user with getCurrentUser.

Upon successful completion, this operation triggers an onIdTokenChanged event in all registered s and an onAuthStateChanged event in all registered AuthStateListeners.

This is equivalent to calling signInWithCredential with an generated by getCredentialWithLink.

Important: you must enable Passwordless sign-in in the Firebase console before being able to use this method.

Exceptions

• FirebaseAuthInvalidUserException thrown if the user account corresponding to email does not exist or has been disabled
• FirebaseAuthInvalidCredentialsException thrown if the password is wrong

See also:

• createUserWithEmailAndPassword
• signInWithCredential
• signInAnonymously
• signInWithCustomToken

Returns
@NonNull Task<AuthResult>	Task of AuthResult with the result of the operation

signOut

public void signOut()

Signs out the current user and clears it from the disk cache.

Upon successful completion, this operation triggers an onIdTokenChanged event in all registered s and an onAuthStateChanged event in all registered AuthStateListeners.

startActivityForSignInWithProvider

public @NonNull Task<AuthResult> startActivityForSignInWithProvider(
    @NonNull Activity activity,
    @NonNull FederatedAuthProvider federatedAuthProvider
)

Signs in the user using the mobile browser (either a Custom Chrome Tab or the device's default browser) for the given provider.

Note: this call has a UI associated with it, unlike the majority of calls in FirebaseAuth.

Exceptions

• FirebaseAuthInvalidCredentialsException thrown if the credential generated from the flow is malformed or expired.
• FirebaseAuthInvalidUserException thrown if the user has been disabled by an administrator.
• FirebaseAuthUserCollisionException thrown if the email that keys the user that is signing in is already in use.
• FirebaseAuthWebException thrown if there is an operation already in progress, the pending operation was canceled, there is a problem with 3rd party cookies in the browser, or some other error in the web context has occurred.
• FirebaseAuthException thrown if signing in via this method has been disabled in the Firebase Console, or if the provider passed is configured improperly.

Parameters
@NonNull Activity activity	the current Activity from which you intend to launch this flow.
@NonNull FederatedAuthProvider federatedAuthProvider	an FederatedAuthProvider configured with information about how you intend the user to sign in.

Returns
@NonNull Task<AuthResult>	a Task with a reference to an AuthResult with user information upon success

updateCurrentUser

public @NonNull Task<Void> updateCurrentUser(@NonNull FirebaseUser user)

Sets the current user to a copy of the given user, but associated with this 's FirebaseApp. If the given user isn't for this project, then a will be returned via the Task.

useAppLanguage

public void useAppLanguage()

Sets the user-facing language code to be the default app language.

useEmulator

public void useEmulator(@NonNull String host, int port)

Modifies this FirebaseAuth instance to communicate with the Firebase Authentication emulator.

Note: this must be called before this instance has been used to do any operations.

Parameters
@NonNull String host	the emulator host (e.g. 10.0.2.2)
int port	the emulator port (e.g. 8080)

verifyPasswordResetCode

public @NonNull Task<String> verifyPasswordResetCode(@NonNull String code)

Checks that the code is a valid password reset out of band code. This code will have been generated by a call to sendPasswordResetEmail, and is valid for a single use.

Returns
@NonNull Task<String>	Task which holds the email for which this code is applicable.