Firebase Authentication Authorized Domain Constraints Without Wildcards
A Firebase project using OAuth redirect or popup sign-in succeeds on localhost because Firebase implicitly authorizes localhost for development, but production origins must appear in the Authentication Authorized Domains list. The list does not support wildcard entries, so ephemeral preview URLs, regional subdomains, or multi-tenant hosts require explicit en