Not totally sure why. Somehow, it helps automating it, I guess. It's Firebase auth API in the native client – I know little about it. That is what Google says: "Use the Authentication settings dashboard to manage authorized domains. The localhost domain is added by default to the approved authentication domains to simplify development. Consider removing localhost from the authorized domains in your production project to prevent bad actors from running code on their localhost to access your production project."