How to fix UNAUTHENTICATED: The caller does not have permission to execute the specified operation. in Firebase

FirebaseINTERMEDIATEHIGHUpdated Dec 22, 2025· 169 views

The UNAUTHENTICATED error occurs when Firebase operations are attempted without valid authentication credentials. This commonly happens in Firestore, Realtime Database, and Cloud Functions when users are not signed in or security rules deny unauthenticated access.

Quick fix

Fixes UNAUTHENTICATED

import { getAuth, signInAnonymously } from "firebase/auth";
import { getFirestore, collection, getDocs } from "firebase/firestore";

const auth = getAuth();
const db = getFirestore();

// Check if user is authenticated
if (!auth.currentUser) {
  // Option 1: Sign in anonymously (allows database access)
  await signInAnonymously(auth);
  // Option 2: Redirect to login page
}

// Now database operations will work
const querySnapshot = await getDocs(collection(db, "users"));
  1. Verify user is authenticated before database operations
  2. Update security rules to allow authenticated access
  3. Sign in user before calling Cloud Functions
  4. Allow anonymous authentication for development/testing
firebase — error
import { getAuth, signInAnonymously } from "firebase/auth";
import { getFirestore, collection, getDocs } from "firebase/firestore";
const auth = getAuth();
const db = getFirestore();
// Check if user is authenticated
if (!auth.currentUser) {
// Option 1: Sign in anonymously (allows database access)
await signInAnonymously(auth);
// Option 2: Redirect to login page
}
// Now database operations will work
const querySnapshot = await getDocs(collection(db, "users"));
UNAUTHENTICATED: The caller does not have permission to execute the specified operation.

What this error means

Firebase returns the UNAUTHENTICATED error when the system cannot verify the identity of the caller making the request. Unlike PERMISSION_DENIED (which means the user is authenticated but lacks access rights), UNAUTHENTICATED means no valid authentication credentials were provided or the auth token is invalid. This error enforces Firebase security rules that restrict database operations to authenticated users only.

Typical symptoms

  • Cloud Functions return error code UNAUTHENTICATED (code 16)
  • Firestore queries fail with "The caller does not have permission" message
  • Realtime Database operations rejected even though code appears correct
  • Mobile app (iOS/Android/Flutter) throws UNAUTHENTICATED on Callable Functions
  • Web app cannot read/write to Firestore without signing in
  • Auth token expired or invalid during operation execution

Common causes

  1. User is not signed in when attempting database operations
  2. Security rules require authentication but user is unauthenticated
  3. Auth token is expired (tokens expire after 1 hour)
  4. Invalid or malformed ID token passed to Callable Function
  5. Firebase Auth SDK not properly initialized before database operations
  6. App Check token validation failure on Callable Functions
  7. Emulator configuration issues not properly connecting Auth and Functions emulators

How to fix "UNAUTHENTICATED: The caller does not have permission to execute the specified operation."

1Verify user is authenticated before database operations

The most common cause is attempting to read/write Firestore or Realtime Database without signing in first. Always check authentication state before querying:

Web/JavaScript:

javascript
import { getAuth, signInAnonymously } from "firebase/auth";
import { getFirestore, collection, getDocs } from "firebase/firestore";

const auth = getAuth();
const db = getFirestore();

// Check if user is authenticated
if (!auth.currentUser) {
  // Option 1: Sign in anonymously (allows database access)
  await signInAnonymously(auth);
  // Option 2: Redirect to login page
}

// Now database operations will work
const querySnapshot = await getDocs(collection(db, "users"));

React with Firebase:

javascript
import { useAuth } from "./useAuth";

function MyComponent() {
  const user = useAuth();

  if (!user) {
    return <div>Please sign in to continue</div>;
  }

  // Database queries here
}

Admin SDK (Node.js) - Backend:
The Admin SDK uses a Service Account which automatically bypasses authentication:

javascript
const admin = require("firebase-admin");
admin.initializeApp({
  credential: admin.credential.cert("/path/to/serviceAccountKey.json"),
});

const db = admin.firestore();
// Admin SDK automatically authenticates, no need to sign in
const docs = await db.collection("users").get();
2Update security rules to allow authenticated access

Check and update your Firestore or Realtime Database security rules to explicitly allow authenticated users:

Firestore Security Rules:

javascript
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Allow authenticated users to read/write
    match /{document=**} {
      allow read, write: if request.auth.uid != null;
    }

    // More restrictive: only owner can access their data
    match /users/{userId} {
      allow read, write: if request.auth.uid == userId;
    }
  }
}

Realtime Database Security Rules:

json
{
  "rules": {
    ".read": "auth != null",
    ".write": "auth != null",
    "users": {
      "$uid": {
        ".read": "auth.uid == $uid",
        ".write": "auth.uid == $uid"
      }
    }
  }
}

To update rules:
1. Go to Firebase Console > Database > Rules tab
2. Paste the rules above
3. Click "Publish"
4. Test with Firebase Emulator Suite locally first

3Sign in user before calling Cloud Functions

Cloud Functions marked as requiring authentication need a valid ID token. Ensure the user is signed in before calling:

Web/JavaScript:

javascript
import { getAuth, signInWithEmailAndPassword } from "firebase/auth";
import { getFunctions, httpsCallable } from "firebase/functions";

const auth = getAuth();
const functions = getFunctions();

// 1. Sign in the user
await signInWithEmailAndPassword(auth, email, password);

// 2. Call the function - auth token is automatically included
const myFunction = httpsCallable(functions, "myFunction");
const result = await myFunction({ data: "value" });

Android/Kotlin:

kotlin
// Sign in first
FirebaseAuth.getInstance().signInWithEmailAndPassword(email, password)
  .addOnSuccessListener {
    // Now call function
    val functions = FirebaseFunctions.getInstance()
    functions.getHttpsCallable("myFunction")
      .call(mapOf("data" to "value"))
      .addOnSuccessListener { result ->
        Log.d("Function", "Success: ${result.data}")
      }
      .addOnFailureListener { exception ->
        Log.e("Function", "Error: ${exception.message}")
      }
  }
  .addOnFailureListener { exception ->
    Log.e("Auth", "Sign in failed: ${exception.message}")
  }

iOS/Swift:

swift
Auth.auth().signIn(withEmail: email, password: password) { result, error in
  guard error == nil else { return }
  
  // User is authenticated, call function
  let functions = Functions.functions()
  functions.httpsCallable("myFunction").call(["data": "value"]) { result, error in
    guard error == nil else {
      print("Function error: \(error?.localizedDescription ?? "Unknown")")
      return
    }
    print("Success: \(result?.data ?? "")")
  }
}
4Allow anonymous authentication for development/testing

If you want to allow unauthenticated access temporarily (development only), sign users in anonymously:

Web/JavaScript:

javascript
import { getAuth, signInAnonymously, onAuthStateChanged } from "firebase/auth";
import { getFirestore, collection, getDocs } from "firebase/firestore";

const auth = getAuth();
const db = getFirestore();

onAuthStateChanged(auth, async (user) => {
  if (!user) {
    // Sign in anonymously if not already signed in
    try {
      await signInAnonymously(auth);
    } catch (error) {
      console.error("Anonymous sign-in failed:", error);
    }
  } else {
    // User is authenticated (anonymously or otherwise)
    const querySnapshot = await getDocs(collection(db, "items"));
    querySnapshot.forEach(doc => console.log(doc.data()));
  }
});

Security Rules for Anonymous Access (Development Only):

javascript
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    // Allow anonymous and authenticated users
    match /{document=**} {
      allow read, write: if request.auth != null;
    }
  }
}

WARNING: Before deploying to production, switch back to authenticated-only rules and remove anonymous sign-in from production code.

5Check and refresh auth tokens for expired credentials

Auth tokens expire after 1 hour. If operations fail after long periods, refresh the token:

Web/JavaScript:

javascript
import { getAuth } from "firebase/auth";

const auth = getAuth();

// Force token refresh
const user = auth.currentUser;
if (user) {
  const refreshedToken = await user.getIdToken(true);
  console.log("Token refreshed:", refreshedToken);
}

// Or let Firebase SDK handle it automatically
onAuthStateChanged(auth, async (user) => {
  if (user) {
    // Firebase automatically refreshes expired tokens
    const token = await user.getIdToken();
  }
});

Check token validity:

javascript
const expirationTime = user.stsTokenManager.expirationTime;
const currentTime = new Date().getTime();

if (currentTime > expirationTime) {
  console.log("Token expired, refreshing...");
  await user.getIdToken(true); // Force refresh
} else {
  console.log("Token is still valid");
}

Admin SDK automatically handles token refresh:

javascript
const admin = require("firebase-admin");
// No need to manage tokens with Admin SDK
const doc = await admin.firestore().collection("users").doc("userId").get();

Advanced notes

When using Firebase Emulator Suite, UNAUTHENTICATED errors often indicate misconfigured emulator connections. Ensure both Auth and Functions emulators are running and the environment variables FIREBASE_AUTH_EMULATOR_HOST and FIREBASE_DATABASE_EMULATOR_HOST are set correctly. Platform-specific issues: iOS/macOS users may encounter UNAUTHENTICATED even with valid tokens due to SDK issues—ensure you're using the latest Firebase SDK versions. Flutter developers using App Check should verify App Check tokens are valid before calling functions. The UNAUTHENTICATED error differs from PERMISSION_DENIED: UNAUTHENTICATED means "no valid credentials" while PERMISSION_DENIED means "authenticated but access denied by rules". Always check error.code in your catch blocks to handle these differently. Service Accounts used by Admin SDK bypass auth entirely—only client SDKs (web, mobile) need authentication.

Frequently asked questions

What does "UNAUTHENTICATED" mean?
Firebase returns the UNAUTHENTICATED error when the system cannot verify the identity of the caller making the request. Unlike PERMISSION_DENIED (which means the user is authenticated but lacks access rights), UNAUTHENTICATED means no valid authentication credentials were provided or the auth token is invalid. This error enforces Firebase security rules that restrict database operations to authenticated users only.
How do I fix "UNAUTHENTICATED"?
The UNAUTHENTICATED error occurs when Firebase operations are attempted without valid authentication credentials. This commonly happens in Firestore, Realtime Database, and Cloud Functions when users are not signed in or security rules deny unauthenticated access.
What causes "UNAUTHENTICATED"?
User is not signed in when attempting database operations Security rules require authentication but user is unauthenticated Auth token is expired (tokens expire after 1 hour)
Is the "UNAUTHENTICATED" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading