How to fix auth/invalid-claims: Custom claim attributes are malformed in Firebase

import { getAuth } from 'firebase-admin/auth';

// ❌ These will cause auth/invalid-claims error
await getAuth().setCustomUserClaims(uid, {
  role: 'admin',
  createdAt: new Date(),           // Date object - not JSON-serializable
  callback: () => {},               // Function - not allowed
  metadata: undefined,              // undefined - not JSON-serializable
  settings: new Map()               // Map object - not serializable
});

import { getAuth } from 'firebase-admin/auth';

// ✅ Valid custom claims
await getAuth().setCustomUserClaims(uid, {
  role: 'admin',
  createdAt: Date.now(),           // Number timestamp
  permissions: ['read', 'write'],   // Array of strings
  settings: {                       // Plain object
    theme: 'dark',
    notifications: true
  },
  departmentId: 'eng-001'
});

import { getAuth } from 'firebase-admin/auth';

const customClaims = {
  role: 'admin',
  permissions: ['read', 'write', 'delete'],
  departmentId: 'engineering',
  teamIds: ['team1', 'team2', 'team3']
};

// Calculate size in bytes
const claimsSize = Buffer.from(JSON.stringify(customClaims)).length;

if (claimsSize > 1000) {
  console.error(`Custom claims too large: ${claimsSize} bytes (max 1000)`);
  // Reduce the payload - remove less critical data
} else {
  await getAuth().setCustomUserClaims(uid, customClaims);
  console.log(`Custom claims set successfully (${claimsSize} bytes)`);
}

// Instead of storing full arrays, use IDs or flags
const optimizedClaims = {
  role: 'admin',           // Keep essential data
  deptId: 'eng',          // Use shorter keys
  perms: 7                // Use bitmask instead of array: 111 (read|write|delete)
};

await getAuth().setCustomUserClaims(uid, {
  role: 'admin',
  iat: Date.now(),        // ❌ Reserved OIDC claim
  firebase: {             // ❌ Reserved by Firebase
    tenant: 'main'
  }
});

await getAuth().setCustomUserClaims(uid, {
  role: 'admin',
  assignedAt: Date.now(),      // ✅ Custom name
  appTenant: 'main',           // ✅ Custom name
  customPermissions: ['read']  // ✅ Custom name
});

import { getAuth } from 'firebase-admin/auth';

interface CustomClaims {
  role: string;
  permissions: string[];
  departmentId?: string;
  metadata?: Record<string, string | number | boolean>;
}

async function setUserClaims(uid: string, claims: CustomClaims) {
  try {
    // Validate claim structure
    const validRoles = ['user', 'admin', 'moderator'];
    if (!validRoles.includes(claims.role)) {
      throw new Error(`Invalid role: ${claims.role}`);
    }

    // Ensure JSON-serializable
    const serialized = JSON.stringify(claims);
    const parsed = JSON.parse(serialized);

    // Check size
    const size = Buffer.from(serialized).length;
    if (size > 1000) {
      throw new Error(`Claims too large: ${size} bytes (max 1000)`);
    }

    // Set claims
    await getAuth().setCustomUserClaims(uid, claims);

    console.log('Custom claims set successfully');

    // Force token refresh on client
    return { success: true, message: 'Claims updated. User must refresh token.' };

  } catch (error: any) {
    if (error.code === 'auth/invalid-claims') {
      console.error('Custom claim attributes are malformed:', error.message);
      return { success: false, error: 'Invalid claim format' };
    }
    throw error;
  }
}

// Usage
await setUserClaims('user123', {
  role: 'admin',
  permissions: ['read', 'write'],
  departmentId: 'engineering'
});

import { getAuth } from 'firebase-admin/auth';

// Set custom claims
await getAuth().setCustomUserClaims(uid, { role: 'admin' });

// Revoke existing tokens to force refresh
await getAuth().revokeRefreshTokens(uid);

console.log('Claims updated. User must sign in again.');

import { getAuth } from 'firebase/auth';

async function refreshUserToken() {
  const auth = getAuth();
  const user = auth.currentUser;

  if (user) {
    // Force token refresh
    const idToken = await user.getIdToken(true);

    // Decode to verify claims (optional)
    const decodedToken = await user.getIdTokenResult();
    console.log('Custom claims:', decodedToken.claims);

    return decodedToken.claims;
  }
}