How to fix functions/permission-denied in Firebase

FirebaseINTERMEDIATEHIGHUpdated Dec 22, 2025· 259 views

The functions/permission-denied error occurs when your Cloud Function lacks IAM permissions to access other Firebase services. This is typically caused by missing or insufficient Cloud IAM roles assigned to the service account running your function.

Quick fix

Fixes functions/permission-denied

  1. Check your function execution service account
  2. Go to IAM & Admin in Google Cloud Console
  3. Find and edit the service account
  4. Assign required roles based on your function operations
  5. Test your function
firebase — error
# functions/permission-denied
functions/permission-denied

What this error means

Firebase Cloud Functions run as a service account with specific IAM roles. When your function tries to access Firestore, Realtime Database, or other Google Cloud services, Firebase checks if that service account has permission. If the required roles are not assigned, the function is denied access and throws a permission-denied error. This differs from Firestore/Database security rules, which only apply to client-side access—backend servers using the Admin SDK bypass security rules entirely. Your function fails at the IAM level, not the database rules level.

Typical symptoms

  • Cloud Function execution fails with "functions/permission-denied" error
  • Function cannot write to or read from Firestore despite rules set to open
  • Calling admin.auth().createCustomToken() fails with permission errors
  • Function deployment succeeds but execution fails when invoked
  • Accessing Realtime Database from a function returns permission denied errors
  • Error appears in Cloud Logs with message about missing service account permissions

Common causes

  1. Service account lacks the "Cloud Functions Invoker" role required to invoke the function
  2. Service account missing "Cloud Datastore User" or "Firebase Admin" role to access Firestore
  3. Service account missing "Service Account Token Creator" role for custom token generation
  4. Function accessing external Google Cloud resources without proper IAM roles assigned
  5. Default App Engine service account has insufficient permissions for the function operations
  6. Deployment configuration missing required IAM setup during function creation

How to fix "functions/permission-denied"

1Check your function execution service account

Navigate to the Google Cloud Console and open the Cloud Functions section. Find your function and note which service account it uses (usually displayed as "Runtime service account"). Most functions use the default App Engine service account or a custom service account.

If you don't see this information, go to Cloud Run services and select your function to view the service account in the Security tab.

2Go to IAM & Admin in Google Cloud Console

In the Google Cloud Console, navigate to IAM & Admin > IAM. This is where you manage permissions for all service accounts in your project.

3Find and edit the service account

In the IAM permissions page, locate your function's service account (e.g., "service-{PROJECT_ID}@appspot.gserviceaccount.com" or your custom service account). Click the pencil/edit icon on the right side of its row.

4Assign required roles based on your function operations

Depending on what your function accesses, assign these roles:

For Firestore access:
- Add "Cloud Datastore User" (roles/datastore.user) - minimum required
- Or add "Firebase Admin" (roles/firebase.admin) - broader access to all Firebase services

For custom token generation:
- Add "Service Account Token Creator" (roles/iam.serviceAccountTokenCreator)

For invoking the function from client code:
- Add "Cloud Functions Invoker" (roles/cloudfunctions.functions.invokeSecurityTestResults.invoke)

Click "Add another role" to add multiple roles. Then save your changes.

5Test your function

Wait a few seconds for IAM changes to propagate (usually 5-30 seconds). Then trigger your Cloud Function again. If the issue was permissions, the function should now execute successfully. If using the Firebase Emulator, restart it to ensure it picks up the updated permissions.

6Verify via Cloud Logs

Go to Cloud Logging (Cloud Logs) and filter by your function name. Check the logs to confirm the function executed without permission errors. Look for successful execution messages or any remaining errors that indicate different issues.

Advanced notes

Security rules vs. IAM: If you're using the Firebase Admin SDK (server-side), security rules in Firestore and Realtime Database are bypassed entirely—your function permission issues are always IAM-related, not rule-related. The permission-denied error comes from Google Cloud IAM, not your database security rules. If using the client SDK from within a function, you'll hit both IAM and security rule checks. Custom roles can be created with minimal permissions instead of using predefined roles if you need fine-grained access control. Firebase Extensions automatically create service accounts with limited permissions; permission errors with extensions usually indicate the extension needs additional roles not granted during installation. For CI/CD pipelines deploying functions, ensure your deployment service account has "Cloud Functions Developer" or "Cloud Functions Admin" roles.

Frequently asked questions

What does "functions/permission-denied" mean?
Firebase Cloud Functions run as a service account with specific IAM roles. When your function tries to access Firestore, Realtime Database, or other Google Cloud services, Firebase checks if that service account has permission. If the required roles are not assigned, the function is denied access and throws a permission-denied error.
How do I fix "functions/permission-denied"?
The functions/permission-denied error occurs when your Cloud Function lacks IAM permissions to access other Firebase services. This is typically caused by missing or insufficient Cloud IAM roles assigned to the service account running your function.
What causes "functions/permission-denied"?
Service account lacks the "Cloud Functions Invoker" role required to invoke the function Service account missing "Cloud Datastore User" or "Firebase Admin" role to access Firestore Service account missing "Service Account Token Creator" role for custom token generation
Is the "functions/permission-denied" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading