Stay organized with collectionsSave and categorize content based on your preferences.
Reauthenticating users
Certain sensitive operations—such as deleting an account, updating a user's email, changing a password, or enabling multi-factor authentication—require the user to have signed in recently. If you perform one of these actions, and the user signed in too long ago, the action fails with an error. Depending on the use case, this can be done withreauthenticateWithPopup(),reauthenticateWithRedirect()orreauthenticateWithCredential().
Example: Reauthenticate Apple Sign-in with Popup
Web version 9
import{getAuth,reauthenticateWithPopup,OAuthProvider}from"firebase/auth";// Result from Redirect auth flow.constauth=getAuth();constprovider=newOAuthProvider('apple.com');reauthenticateWithPopup(auth.currentUser,provider).then((result)=>{// User is re-authenticated with fresh tokens minted and can perform// sensitive operations like account deletion, or updating their email// address or password.// The signed-in user info.constuser=result.user;// You can also get the Apple OAuth Access and ID Tokens.constcredential=OAuthProvider.credentialFromResult(result);constaccessToken=credential.accessToken;constidToken=credential.idToken;// ...}).catch((error)=>{// Handle Errors here.consterrorCode=error.code;consterrorMessage=error.message;// The email of the user's account used.constemail=error.customData.email;// The credential that was used.constcredential=OAuthProvider.credentialFromError(error);// ...});
constprovider=newfirebase.auth.OAuthProvider('apple.com');firebase.auth().currentUser.reauthenticateWithPopup(provider).then((result)=>{// User is re-authenticated with fresh tokens minted and can perform// sensitive operations like account deletion, or updating their email// address or password./** @type {firebase.auth.OAuthCredential} */varcredential=result.credential;// The signed-in user info.varuser=result.user;// You can also get the Apple OAuth Access and ID Tokens.varaccessToken=credential.accessToken;varidToken=credential.idToken;// IdP data available in result.additionalUserInfo.profile.// ...}).catch((error)=>{// Handle Errors here.varerrorCode=error.code;varerrorMessage=error.message;// The email of the user's account used.varemail=error.email;// The firebase.auth.AuthCredential type that was used.varcredential=error.credential;// ...});
import{getAuth,reauthenticateWithCredential}from"firebase/auth";constauth=getAuth();constuser=auth.currentUser;// TODO(you): prompt the user to re-provide their sign-in credentialsconstcredential=promptForCredentials();reauthenticateWithCredential(user,credential).then(()=>{// User re-authenticated.}).catch((error)=>{// An error ocurred// ...});
constuser=firebase.auth().currentUser;// TODO(you): prompt the user to re-provide their sign-in credentialsconstcredential=promptForCredentials();user.reauthenticateWithCredential(credential).then(()=>{// User re-authenticated.}).catch((error)=>{// An error occurred// ...});
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[[["\u003cp\u003eSensitive actions like account deletion or password changes require users to reauthenticate if their initial login was too long ago.\u003c/p\u003e\n"],["\u003cp\u003eReauthentication can be achieved using methods like \u003ccode\u003ereauthenticateWithPopup()\u003c/code\u003e, \u003ccode\u003ereauthenticateWithRedirect()\u003c/code\u003e, or \u003ccode\u003ereauthenticateWithCredential()\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eSuccessful reauthentication allows users to perform sensitive operations and obtain fresh tokens and user information.\u003c/p\u003e\n"],["\u003cp\u003eErrors during reauthentication can be handled to manage issues like incorrect credentials, which may contain information like error codes and the user's email.\u003c/p\u003e\n"],["\u003cp\u003eDifferent versions of the Web API might have slight differences in code structure, however, the core functionality remains the same.\u003c/p\u003e\n"]]],[],null,["# Reauthenticating users\n======================\n\nCertain sensitive operations---such as deleting an account, updating a user's email, changing a password, or enabling multi-factor authentication---require the user to have signed in recently. If you perform one of these actions, and the user signed in too long ago, the action fails with an error. Depending on the use case, this can be done with `reauthenticateWithPopup()`, `reauthenticateWithRedirect()` or `reauthenticateWithCredential()`.\n\nExample: Reauthenticate Apple Sign-in with Popup\n------------------------------------------------\n\n### Web version 9\n\n```javascript\nimport { getAuth, reauthenticateWithPopup, OAuthProvider } from \"firebase/auth\";\n\n// Result from Redirect auth flow.\nconst auth = getAuth();\nconst provider = new OAuthProvider('apple.com');\n\nreauthenticateWithPopup(auth.currentUser, provider)\n .then((result) =\u003e {\n // User is re-authenticated with fresh tokens minted and can perform\n // sensitive operations like account deletion, or updating their email\n // address or password.\n\n // The signed-in user info.\n const user = result.user;\n\n // You can also get the Apple OAuth Access and ID Tokens.\n const credential = OAuthProvider.credentialFromResult(result);\n const accessToken = credential.accessToken;\n const idToken = credential.idToken;\n\n // ...\n })\n .catch((error) =\u003e {\n // Handle Errors here.\n const errorCode = error.code;\n const errorMessage = error.message;\n // The email of the user's account used.\n const email = error.customData.email;\n // The credential that was used.\n const credential = OAuthProvider.credentialFromError(error);\n\n // ...\n });https://github.com/firebase/snippets-web/blob/467eaa165dcbd9b3ab15711e76fa52237ba37f8b/snippets/auth-next/apple/auth_apple_reauthenticate_popup.js#L8-L40\n```\n\n### Web version 8\n\n```javascript\nconst provider = new firebase.auth.OAuthProvider('apple.com');\n\nfirebase\n .auth()\n .currentUser\n .reauthenticateWithPopup(provider)\n .then((result) =\u003e {\n // User is re-authenticated with fresh tokens minted and can perform\n // sensitive operations like account deletion, or updating their email\n // address or password.\n /** @type {firebase.auth.OAuthCredential} */\n var credential = result.credential;\n\n // The signed-in user info.\n var user = result.user;\n // You can also get the Apple OAuth Access and ID Tokens.\n var accessToken = credential.accessToken;\n var idToken = credential.idToken;\n\n // IdP data available in result.additionalUserInfo.profile.\n // ...\n })\n .catch((error) =\u003e {\n // Handle Errors here.\n var errorCode = error.code;\n var errorMessage = error.message;\n // The email of the user's account used.\n var email = error.email;\n // The firebase.auth.AuthCredential type that was used.\n var credential = error.credential;\n\n // ...\n });https://github.com/firebase/snippets-web/blob/467eaa165dcbd9b3ab15711e76fa52237ba37f8b/auth/apple.js#L103-L135\n```\n\nExample: `reauthenticateWithCredential()`\n-----------------------------------------\n\n### Web version 9\n\n```javascript\nimport { getAuth, reauthenticateWithCredential } from \"firebase/auth\";\n\nconst auth = getAuth();\nconst user = auth.currentUser;\n\n// TODO(you): prompt the user to re-provide their sign-in credentials\nconst credential = promptForCredentials();\n\nreauthenticateWithCredential(user, credential).then(() =\u003e {\n // User re-authenticated.\n}).catch((error) =\u003e {\n // An error ocurred\n // ...\n});https://github.com/firebase/snippets-web/blob/467eaa165dcbd9b3ab15711e76fa52237ba37f8b/snippets/auth-next/manage/auth_reauth_with_credential.js#L8-L21\n```\n\n### Web version 8\n\n```javascript\nconst user = firebase.auth().currentUser;\n\n// TODO(you): prompt the user to re-provide their sign-in credentials\nconst credential = promptForCredentials();\n\nuser.reauthenticateWithCredential(credential).then(() =\u003e {\n // User re-authenticated.\n}).catch((error) =\u003e {\n // An error occurred\n // ...\n});https://github.com/firebase/snippets-web/blob/467eaa165dcbd9b3ab15711e76fa52237ba37f8b/auth/manage.js#L139-L149\n```"]]
