How to fix INVALID_ARGUMENT: Invalid claim in auth token in Firebase

import { initializeApp, cert } from 'firebase-admin/app';

// This service account MUST be from the correct Firebase project
const serviceAccount = require('./path/to/serviceAccountKey.json');

// Verify the project_id in the service account
console.log('Service Account Project ID:', serviceAccount.project_id);

initializeApp({
  credential: cert(serviceAccount),
  projectId: serviceAccount.project_id  // Explicit project ID
});

import { initializeApp } from 'firebase/app';

const firebaseConfig = {
  apiKey: "YOUR_API_KEY",
  authDomain: "YOUR_PROJECT.firebaseapp.com",
  projectId: "YOUR_PROJECT_ID",  // Must match Admin SDK
  storageBucket: "YOUR_PROJECT.appspot.com",
  messagingSenderId: "YOUR_SENDER_ID",
  appId: "YOUR_APP_ID"
};

const app = initializeApp(firebaseConfig);

// Verify the project ID matches
console.log('Client Project ID:', firebaseConfig.projectId);

# Service account project_id
grep project_id serviceAccountKey.json

# Client config projectId
grep projectId src/firebase-config.ts

import { getAuth } from 'firebase-admin/auth';
import jwt_decode from 'jwt-decode';

// Get token from client
const idToken = await user.getIdToken();

// Decode token (don't verify yet)
const decoded = jwt_decode<any>(idToken);

console.log('Token Claims:');
console.log('  aud (audience/project):', decoded.aud);
console.log('  iss (issuer):', decoded.iss);
console.log('  sub (user):', decoded.sub);
console.log('  iat (issued at):', new Date(decoded.iat * 1000));
console.log('  exp (expires):', new Date(decoded.exp * 1000));

{
  aud: "my-app-12345",  // Audience should be your project ID
  iss: "https://securetoken.google.com/my-app-12345",  // Issuer should be Google's token server for your project
  sub: "user_uid_here",
  iat: 1672531200,
  exp: 1672534800
}

import { getAuth, signOut } from 'firebase/auth';

const auth = getAuth();

// Sign out to clear cached tokens
await signOut(auth);

// User must sign in again with correct project
console.log('User signed out. They must sign in again.');

import FirebaseAuth

// Check current app configuration
if let app = FirebaseApp.app() {
  print("Current Firebase App Name:", app.name)
}

// Clear keychain by signing out
do {
  try Auth.auth().signOut()
  print("User signed out and token cleared")
} catch let signOutError as NSError {
  print("Error signing out:", signOutError.code)
}

import com.google.firebase.auth.FirebaseAuth

val auth = FirebaseAuth.getInstance()
auth.signOut()

// Clear credential cache
FirebaseAuth.getInstance().currentUser = null

# Download service account from Firebase Console
# Firebase Console > Project Settings > Service Accounts > Generate New Private Key

# Check the project_id in the downloaded file
cat serviceAccountKey.json | jq '.project_id'

# Should output: "my-app-12345"

import { initializeApp, cert } from 'firebase-admin/app';
import { getAuth } from 'firebase-admin/auth';

// Load the correct service account
const serviceAccountKey = JSON.parse(
  process.env.FIREBASE_SERVICE_ACCOUNT_KEY || '{}'
);

// Initialize with explicit project ID
const app = initializeApp({
  credential: cert(serviceAccountKey),
  projectId: serviceAccountKey.project_id,
  databaseURL: `https://${serviceAccountKey.project_id}.firebaseio.com`
});

const auth = getAuth(app);

export { auth };

// ❌ WRONG - Using service account from different project
const wrongServiceAccount = require('./staging-serviceAccountKey.json');
initializeApp({
  credential: cert(wrongServiceAccount)  // This is from staging, not production
});

// ✅ CORRECT - Using service account from same project
const correctServiceAccount = require('./production-serviceAccountKey.json');
initializeApp({
  credential: cert(correctServiceAccount)  // This is from production
});

// Environment-specific configuration
const firebaseConfig = process.env.NODE_ENV === 'production'
  ? {
      projectId: 'my-app-production',
      databaseURL: 'https://my-app-production.firebaseio.com'
    }
  : {
      projectId: 'my-app-staging',
      databaseURL: 'https://my-app-staging.firebaseio.com'
    };

// Load matching service account
const serviceAccountPath = process.env.NODE_ENV === 'production'
  ? './serviceAccounts/production.json'
  : './serviceAccounts/staging.json';

const serviceAccount = require(serviceAccountPath);

initializeApp({
  credential: cert(serviceAccount),
  projectId: firebaseConfig.projectId
});

// src/firebase-config.ts
const firebaseConfig = process.env.REACT_APP_FIREBASE_PROJECT_ID === 'my-app-production'
  ? {
      apiKey: process.env.REACT_APP_FIREBASE_API_KEY_PROD,
      authDomain: "my-app-production.firebaseapp.com",
      projectId: "my-app-production",
      storageBucket: "my-app-production.appspot.com"
    }
  : {
      apiKey: process.env.REACT_APP_FIREBASE_API_KEY_STAGING,
      authDomain: "my-app-staging.firebaseapp.com",
      projectId: "my-app-staging",
      storageBucket: "my-app-staging.appspot.com"
    };

export default firebaseConfig;

import { getAuth } from 'firebase-admin/auth';
import jwt_decode from 'jwt-decode';

async function verifyAndDecodedToken(idToken: string) {
  try {
    // Decode without verification first to inspect claims
    const unverified = jwt_decode<any>(idToken);

    console.log('Token Claims:');
    console.log('  Project ID (aud):', unverified.aud);
    console.log('  Issuer (iss):', unverified.iss);
    console.log('  Expected Project:', process.env.FIREBASE_PROJECT_ID);

    // Check if project matches
    if (unverified.aud !== process.env.FIREBASE_PROJECT_ID) {
      throw new Error(
        `Token from wrong project. Expected "${process.env.FIREBASE_PROJECT_ID}" but got "${unverified.aud}"`
      );
    }

    // Now verify with Admin SDK
    const decodedToken = await getAuth().verifyIdToken(idToken);
    return decodedToken;

  } catch (error: any) {
    if (error.code === 'auth/invalid-argument') {
      console.error('Invalid token claim - project mismatch');
      console.error('Error details:', error.message);
      // Log for debugging
      throw new Error('Authentication failed: token from different Firebase project');
    }
    throw error;
  }
}

// Usage
const uid = await verifyAndDecodedToken(clientToken)
  .catch(error => {
    console.error('Verification failed:', error.message);
    return null;
  });

async function authenticateRequest(req: Request) {
  const idToken = extractTokenFromHeader(req);

  try {
    const decodedToken = await getAuth().verifyIdToken(idToken);
    return { success: true, uid: decodedToken.uid };
  } catch (error: any) {
    if (error.code === 'auth/invalid-argument') {
      return {
        success: false,
        error: 'Your authentication token is not valid for this service. Please sign in again.',
        debug: error.message
      };
    }
    throw error;
  }
}