How to fix PERMISSION_DENIED: The caller does not have the required role in Firebase

FirebaseINTERMEDIATEHIGHUpdated Dec 22, 2025· 168 views

The "Caller does not have required role" error occurs when your Firebase project member, service account, or client lacks sufficient IAM permissions or security rule clearance. This is typically resolved by granting the appropriate IAM roles or fixing Firestore security rules.

Quick fix

Fixes PERMISSION_DENIED: The caller does not have the required role

import { getAuth } from "firebase/auth";
import { getFirestore, doc, getDoc } from "firebase/firestore";

const auth = getAuth();
const currentUser = auth.currentUser;

if (currentUser) {
  console.log("User authenticated:", currentUser.uid);
  const db = getFirestore();
  const docRef = doc(db, "users", currentUser.uid);
  const docSnap = await getDoc(docRef);
} else {
  console.log("User not authenticated");
  // Sign in user first
}
  1. Check authentication status in client code
  2. Review and update Firestore security rules
  3. Grant IAM roles to the service account (Cloud Functions/Backend)
  4. Enable required Google Cloud APIs
firebase — error
import { getAuth } from "firebase/auth";
import { getFirestore, doc, getDoc } from "firebase/firestore";
const auth = getAuth();
const currentUser = auth.currentUser;
if (currentUser) {
  console.log("User authenticated:", currentUser.uid);
  const db = getFirestore();
  const docRef = doc(db, "users", currentUser.uid);
  const docSnap = await getDoc(docRef);
} else {
  console.log("User not authenticated");
  // Sign in user first
}
PERMISSION_DENIED: The caller does not have the required role

What this error means

This error is thrown by Firebase when an authenticated or service account user attempts an operation they lack permissions for. The error has two distinct contexts: (1) Cloud Functions or backend access to Firestore/Realtime Database, where IAM roles control permissions, and (2) Client-side Firestore access, where security rules enforce access control. In both cases, Firebase servers reject the operation because the principal (user, service account, or function) does not have the required permissions to execute that specific operation.

Typical symptoms

  • Cloud Functions fail to read/write Firestore documents despite being deployed successfully
  • Firebase CLI deployment fails with "The caller does not have permission" error
  • Backend services using Admin SDK cannot access Firestore
  • Client-side code throws permission-denied errors even for authenticated users
  • HTTP 403 Forbidden responses when calling Firebase APIs

Common causes

  1. Service account running Cloud Functions lacks the Cloud Datastore User (roles/datastore.user) or Firebase Admin (roles/firebase.admin) IAM role
  2. Firestore security rules require authentication but the client is not signed in
  3. Firestore security rules explicitly deny the requested operation for the user role
  4. IAM policy for the service account or project member is too restrictive
  5. Permissions cached from previous IAM policy changes (cache expires in 5 minutes)
  6. Cloud APIs required for the operation are not enabled in the Google Cloud project

How to fix "PERMISSION_DENIED: The caller does not have the required role"

1Check authentication status in client code

For client-side Firestore access, verify that your user is properly authenticated before attempting database operations:

javascript
import { getAuth } from "firebase/auth";
import { getFirestore, doc, getDoc } from "firebase/firestore";

const auth = getAuth();
const currentUser = auth.currentUser;

if (currentUser) {
  console.log("User authenticated:", currentUser.uid);
  const db = getFirestore();
  const docRef = doc(db, "users", currentUser.uid);
  const docSnap = await getDoc(docRef);
} else {
  console.log("User not authenticated");
  // Sign in user first
}

If the user is not authenticated, sign them in using Firebase Authentication before accessing Firestore.

2Review and update Firestore security rules

Access the Firestore Security Rules in the Firebase Console and ensure they allow the operations your users need. For authenticated users with basic read/write access:

bash
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if request.auth != null;
    }
  }
}

For user-specific access, use more granular rules:

bash
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      allow read, write: if request.auth.uid == userId;
    }
    match /public/{document=**} {
      allow read: if true;
    }
  }
}

After updating rules, click "Publish" and wait for them to deploy (usually 1-2 minutes).

3Grant IAM roles to the service account (Cloud Functions/Backend)

For Cloud Functions or backend services using the Admin SDK, grant the required IAM roles to the service account in Google Cloud Console:

1. Go to Google Cloud Console > IAM & Admin > IAM
2. Find the service account (usually named "App Engine default service account" with format: PROJECT_ID@appspot.gserviceaccount.com)
3. Click the edit icon and add these roles:
 - Cloud Datastore User (roles/datastore.user) - minimum required
 - Firebase Admin (roles/firebase.admin) - broader access

Alternatively, use the gcloud CLI:

bash
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member=serviceAccount:PROJECT_ID@appspot.gserviceaccount.com \
  --role=roles/datastore.user

# Or for broader access:
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member=serviceAccount:PROJECT_ID@appspot.gserviceaccount.com \
  --role=roles/firebase.admin

After granting roles, it takes up to 5 minutes for the permissions to take effect due to IAM caching.

4Enable required Google Cloud APIs

Ensure the necessary APIs are enabled in your Google Cloud project:

1. Go to Google Cloud Console > APIs & Services > Library
2. Search for and enable:
 - Cloud Firestore API
 - Cloud Functions API (if using functions)
 - Service Usage API

Using the gcloud CLI:

bash
gcloud services enable firestore.googleapis.com
gcloud services enable cloudfunctions.googleapis.com
gcloud services enable serviceusage.googleapis.com

Missing enabled APIs will cause permission errors even with correct IAM roles.

5Test rules with the Rules Playground

Before deploying security rule changes to production, test them in the Firebase Console:

1. In Firebase Console, go to Firestore Database > Rules
2. Click the Rules Playground button (or tab)
3. Enter test values:
 - Authentication: Mock the auth object (set uid, email, or custom claims)
 - Request path: The document path being accessed (e.g., /users/user123)
 - Request method: Read, Write, or Delete
4. Click Run to see if the rule allows or denies the request
5. Iterate on rules until tests pass
6. Click Publish to deploy

This prevents deploying broken rules to production.

6Verify service account credentials (if using custom service account)

If using a custom service account (not App Engine default), verify credentials are correct:

1. Go to Google Cloud Console > Service Accounts
2. Select your service account and click Keys
3. If the key is old or expired, create a new one:
 - Click Add Key > Create new key > JSON
 - Download and store securely
4. In your backend code, initialize the Admin SDK:

javascript
import admin from 'firebase-admin';

const serviceAccount = require('./path/to/serviceAccountKey.json');

admin.initializeApp({
  credential: admin.credential.cert(serviceAccount),
  databaseURL: 'https://YOUR_PROJECT.firebaseio.com',
});

const db = admin.firestore();
// Now you can access Firestore without permission issues

The Admin SDK bypasses security rules entirely, so if you still get permission errors with Admin SDK, it indicates an IAM role problem, not a security rules problem.

Advanced notes

Admin SDK Bypass: When using Firebase Admin SDK from a backend (Node.js, Python, etc.), security rules are bypassed entirely. If you still encounter permission errors with Admin SDK, the issue is IAM permissions, not security rules.

Permission Caching: Cloud Firestore caches IAM permissions for 5 minutes. After updating IAM roles, allow up to 5 minutes for changes to take effect.

firebaserules.system Service Account: Firebase automatically manages a special service account (service-PROJECT_NUMBER@firebase-rules.iam.gserviceaccount.com) that evaluates security rules. Do not remove the roles/firebaserules.system role from this service account, or all security rules will be denied.

Custom IAM Roles: For fine-grained access control, create custom IAM roles with specific permissions like firestore.databases.get, firestore.documents.list, etc.

Testing with Emulator: Use the Cloud Firestore emulator locally to test security rules and IAM policies before deploying:

bash
firebase emulators:start --only firestore

This allows rapid iteration without affecting production.

Frequently asked questions

What does "PERMISSION_DENIED: The caller does not have the required role" mean?
This error is thrown by Firebase when an authenticated or service account user attempts an operation they lack permissions for. The error has two distinct contexts: (1) Cloud Functions or backend access to Firestore/Realtime Database, where IAM roles control permissions, and (2) Client-side Firestore access, where security rules enforce access control. In both cases, Firebase servers reject the operation because the principal (user, service account, or function) does not have the required permissions to execute that specific operation.
How do I fix "PERMISSION_DENIED: The caller does not have the required role"?
The "Caller does not have required role" error occurs when your Firebase project member, service account, or client lacks sufficient IAM permissions or security rule clearance. This is typically resolved by granting the appropriate IAM roles or fixing Firestore security rules.
What causes "PERMISSION_DENIED: The caller does not have the required role"?
Service account running Cloud Functions lacks the Cloud Datastore User (roles/datastore.user) or Firebase Admin (roles/firebase.admin) IAM role Firestore security rules require authentication but the client is not signed in Firestore security rules explicitly deny the requested operation for the user role
Is the "PERMISSION_DENIED: The caller does not have the required role" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading