How to fix Callable Functions: UNAUTHENTICATED - Invalid credentials in Firebase

FirebaseBEGINNERHIGH

This error occurs when a Firebase Callable Function rejects a request due to missing, invalid, or expired authentication credentials. The client must be signed in with Firebase Authentication, and the ID token must be valid and properly included in the request headers.

What this error means

The UNAUTHENTICATED error in Firebase Callable Functions indicates that the request to your cloud function failed authentication validation. Firebase callable functions automatically handle authentication by extracting and validating the user's ID token from the request. If the token is missing, expired, invalid, or cannot be verified, the request is rejected immediately with a 401 Unauthorized response. This is a security feature that prevents unauthenticated requests from reaching your function code. The "Invalid credentials" variant specifically means Firebase was able to detect and parse the authentication token, but the token itself failed validation - either because it was expired, revoked, tampered with, or the user's account is no longer valid. Unlike regular HTTP functions where you manually check authentication, callable functions enforce this automatically. The Firebase client SDKs are responsible for obtaining a valid ID token from Firebase Authentication and including it in every callable function request.

How to fix "Callable Functions: UNAUTHENTICATED - Invalid credentials"

1Verify the user is signed in before calling the function

The most common cause of this error is calling a callable function while the user is not authenticated. Always check that a user is signed in before invoking the function.

javascript

// Web SDK
import { getAuth, onAuthStateChanged } from 'firebase/auth';
import { getFunctions, httpsCallable } from 'firebase/functions';

const auth = getAuth();

onAuthStateChanged(auth, (user) => {
  if (user) {
    // User is signed in, safe to call function
    const functions = getFunctions();
    const myFunction = httpsCallable(functions, 'myFunctionName');
    myFunction({ data: 'value' }).then(result => {
      console.log('Success:', result.data);
    }).catch(error => {
      console.error('Function error:', error.code, error.message);
    });
  } else {
    console.log('User is not signed in');
  }
});

kotlin

// Android
import com.google.firebase.auth.ktx.auth
import com.google.firebase.functions.ktx.functions
import com.google.firebase.ktx.Firebase

val auth = Firebase.auth
val currentUser = auth.currentUser

if (currentUser != null) {
  val functions = Firebase.functions
  functions.getHttpsCallable("myFunctionName")
    .call(mapOf("data" to "value"))
    .addOnSuccessListener { result ->
      Log.d("Function", "Success: ${result.data}")
    }
    .addOnFailureListener { exception ->
      Log.e("Function", "Error: ${exception.message}")
    }
} else {
  Log.d("Auth", "User is not signed in")
}

swift

// iOS/Swift
import FirebaseAuth
import FirebaseFunctions

let auth = Auth.auth()

if let user = auth.currentUser {
  let functions = Functions.functions()
  functions.httpsCallable("myFunctionName").call(["data": "value"]) { result, error in
    if let error = error {
      print("Error: \(error.localizedDescription)")
    } else {
      print("Success: \(result?.data ?? "")")
    }
  }
} else {
  print("User is not signed in")
}

Wait for the authentication state to be determined before calling any callable functions. Use the SDK's auth state listener rather than checking synchronously, as auth initialization is asynchronous.

2Sign in the user with Firebase Authentication

If no user is signed in, authenticate first using Firebase Authentication methods before calling callable functions. All callable functions require an authenticated user.

javascript

// Email/password sign-in
import { getAuth, signInWithEmailAndPassword } from 'firebase/auth';
import { getFunctions, httpsCallable } from 'firebase/functions';

const auth = getAuth();

signInWithEmailAndPassword(auth, '[email protected]', 'password')
  .then((userCredential) => {
    // User is now signed in, can call functions
    const functions = getFunctions();
    const myFunction = httpsCallable(functions, 'myFunctionName');
    return myFunction({ userId: userCredential.user.uid });
  })
  .catch((error) => {
    console.error('Sign-in error:', error.code);
  });

javascript

// Anonymous sign-in
import { getAuth, signInAnonymously } from 'firebase/auth';

const auth = getAuth();

signInAnonymously(auth)
  .then((userCredential) => {
    console.log('Signed in anonymously as:', userCredential.user.uid);
    // Can now call functions
  })
  .catch((error) => {
    console.error('Error:', error.code);
  });

javascript

// Google Sign-in
import { getAuth, signInWithPopup, GoogleAuthProvider } from 'firebase/auth';

const auth = getAuth();
const provider = new GoogleAuthProvider();

signInWithPopup(auth, provider)
  .then((result) => {
    // User is signed in with Google
  })
  .catch((error) => {
    console.error('Error:', error.code);
  });

Choose the authentication method appropriate for your application (email, social login, anonymous, etc.).

3Ensure ID token is being automatically included

The Firebase client SDKs automatically include the user's ID token in callable function requests. Verify you are using the official SDK's httpsCallable function, not making raw HTTP requests.

javascript

// Correct - SDK automatically includes token
import { getFunctions, httpsCallable } from 'firebase/functions';

const functions = getFunctions();
const myFunction = httpsCallable(functions, 'myFunctionName');
await myFunction({ /* data */ }); // Token included automatically

javascript

// Incorrect - manual HTTP request (token not included)
const response = await fetch('https://us-central1-myproject.cloudfunctions.net/myFunction', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ /* data */ })
  // Token is NOT automatically included
});

If you need to make raw HTTP requests, you must manually obtain the ID token and include it:

javascript

import { getAuth } from 'firebase/auth';

const auth = getAuth();
const token = await auth.currentUser.getIdToken();

const response = await fetch('https://us-central1-myproject.cloudfunctions.net/myFunction', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer ' + token // Must include token manually
  },
  body: JSON.stringify({ data: { /* your data */ } })
});

Always use the official SDK's httpsCallable when possible, as it handles token management automatically.

4Force token refresh if user has been idle

ID tokens expire after one hour. If a user has been idle or the token may have expired, force a refresh before calling the function.

javascript

import { getAuth } from 'firebase/auth';
import { getFunctions, httpsCallable } from 'firebase/functions';

const auth = getAuth();

// Force token refresh
await auth.currentUser.getIdToken(true);

// Now call the function with fresh token
const functions = getFunctions();
const myFunction = httpsCallable(functions, 'myFunctionName');
const result = await myFunction({ userId: auth.currentUser.uid });

kotlin

// Android
val user = Firebase.auth.currentUser
user?.getIdToken(true)?.addOnSuccessListener { result ->
  val token = result.token
  // Token is now refreshed, can call function
  val functions = Firebase.functions
  functions.getHttpsCallable("myFunctionName").call(mapOf())
}

swift

// iOS
Auth.auth().currentUser?.getIDTokenForcingRefresh(true) { idToken, error in
  if let error = error {
    print("Error refreshing token: \(error.localizedDescription)")
    return
  }
  // Token is refreshed, can now call function
  let functions = Functions.functions()
  functions.httpsCallable("myFunctionName").call(nil)
}

The SDK typically handles this automatically, but forcing a refresh can resolve issues with expired tokens.

5Verify Firebase project configuration matches

Ensure your client app and cloud function are configured for the same Firebase project. Mismatched configurations will cause authentication failures.

javascript

// Client - check configuration
import { initializeApp } from 'firebase/app';

const firebaseConfig = {
  apiKey: 'YOUR_API_KEY',
  projectId: 'YOUR_PROJECT_ID',
  appId: 'YOUR_APP_ID'
  // ... other config
};

const app = initializeApp(firebaseConfig);
console.log('Configured project:', firebaseConfig.projectId);

javascript

// Server - check configuration in firebase.json
{
  "functions": {
    "source": "functions",
    "codebase": "default",
    "runtime": "nodejs18"
  },
  "firebaserc": ".firebaserc"
}

Check that:
- The API Key is for the correct Firebase project
- The Project ID in client config matches your Firebase project
- Cloud Functions are deployed to the same project
- No proxy or alternative endpoints are being used

You can verify the current project with:

bash

firebase projects:list
firebase use --list  # Shows currently selected project

6Check Firebase Authentication is enabled

Verify that Firebase Authentication is enabled in your Firebase Console and that your project allows sign-ups for your authentication method.

In Firebase Console:
1. Go to Authentication section
2. Ensure the service shows "Enabled"
3. Check the "Sign-in method" tab
4. Enable at least one authentication provider (Email/Password, Google, Anonymous, etc.)

bash

# Verify via Firebase CLI
firebase auth:import users.json  # This will tell you if auth is enabled

# Or check project settings
firebase projects:list

If Authentication is disabled, enable it in the Console before attempting to use callable functions.

How to fix Callable Functions: UNAUTHENTICATED - Invalid credentials in Firebase

What this error means

Typical symptoms

Common causes

How to fix "Callable Functions: UNAUTHENTICATED - Invalid credentials"

Advanced notes

Related errors

Official resources & further reading