# Firebase Functions: 403 Forbidden, the request was not authenticated
> A 2nd gen Firebase function returns 403: the caller isn’t allowed to invoke it. Make it public with invoker, or send an ID token from an allowed account.
Canonical: https://app369.com/fix/firebase-functions-403-forbidden/
Last updated: 2026-11-09
A 403 from a 2nd gen Firebase function means Cloud Run refused the caller before your code ran. The function isn’t public, or the call has no valid token from an account with the Cloud Run Invoker role.
**Short answer**
For a public endpoint, set invoker: 'public' on the function and deploy again. If the deploy can’t make it public, an organization policy or a missing deploy permission is the likely cause. For a private function, call it with an ID token from a service account that has the Cloud Run Invoker role.
Rather not fix it yourself? [**App Fix Ticket**](https://app369.com/fixed-price/flutter-firebase-bug-fix/) starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.
## **Why Cloud Run refuses the call, and the fix**
1. 01 ### **The function isn’t public**
> “Invoker to set access control on https functions.” [**Firebase, HttpsOptions.invoker**](https://firebase.google.com/docs/reference/functions/2nd-gen/node/firebase-functions.https.httpsoptions.md) A 2nd gen function runs on Cloud Run, which checks who may call it. Set invoker on the function so the deploy grants public access, and deploy again.```
import { onRequest } from 'firebase-functions/v2/https';
export const webhook = onRequest({ invoker: 'public' }, async (req, res) => {
// check a signature or secret here: anyone can call a public URL
res.send('ok');
});
```
2. 02 ### **The deploy couldn’t make it public** If the deploy output says it could not set the IAM policy for the function, an organization policy on the Google Cloud project may block public access, or the account running firebase deploy may lack permission to change who can invoke the service. The function then deploys but stays private. An admin has to allow it, or callers must authenticate.
3. 03 ### **A private function is called without a token**
> “HTTP 403: The request was not authenticated. Either allow public access or set the proper Authorization header” [**Google Cloud, Cloud Run troubleshooting**](https://cloud.google.com/run/docs/troubleshooting) Cloud Scheduler, Cloud Tasks, another service or a script must send an ID token for an account with the Cloud Run Invoker role. Configure an OIDC token on the scheduler job or task, or fetch one in your server code. To test, call the URL with curl and an Authorization: Bearer header set to the output of gcloud auth print-identity-token. If that works and a plain call gets 403, the function is private.
4. 04 ### **The token’s account lacks the role**
> “If a service account invokes your service, ensure that the service account is a member of the Cloud Run service, and grant the Cloud Run Invoker (roles/run.invoker) role.” [**Google Cloud, Cloud Run troubleshooting**](https://cloud.google.com/run/docs/troubleshooting) A valid token still fails if its account can’t invoke the service. Grant Cloud Run Invoker to that service account on the function’s Cloud Run service.
Checked against the vendor’s docs on November 9, 2026: [Firebase reference: HttpsOptions (invoker)](https://firebase.google.com/docs/reference/functions/2nd-gen/node/firebase-functions.https.httpsoptions.md); [Google Cloud: Cloud Run troubleshooting](https://cloud.google.com/run/docs/troubleshooting).
## **Rather hand it over?**
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- [from $450**App Fix Ticket**One reproducible bug in an existing mobile or web app, diagnosed and fixed.**See scope and start**](https://app369.com/fixed-price/flutter-firebase-bug-fix/)
- [from $450**AI-Built App Rescue**A Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.****No issues worth fixing, no charge.**** If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.**See scope and start**](https://app369.com/fixed-price/ai-app-rescue/)
[**All 127 Fiverr reviews**](https://app369.com/reviews/)
Related: [**Firebase Functions CORS error**](https://app369.com/fix/firebase-functions-cors-error/) · [**Firebase Functions deploy failed**](https://app369.com/fix/firebase-functions-deploy-failed/) · [**Firebase App Check blocking requests**](https://app369.com/fix/firebase-app-check-blocking-requests/) · [**Firebase callable INTERNAL error**](https://app369.com/fix/firebase-functions-callable-internal-error/)
Questions
## **More on this error**
**Why does the browser show a CORS error instead? **+
A 403 from Cloud Run has no CORS headers, so the browser reports CORS. Fix the 403 first, then check CORS if it remains.
**Is a public function unsafe? **+
Public means anyone can reach the URL, not that anyone can do anything. Check a signature, a secret or the user’s Firebase ID token inside the function.
**Can you fix it for me? **+
If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.
A different error?
## **Describe it and get a written quote**
Send the error and what you were doing. You get a written scope, a fixed price and a timeline; Simon replies by email, usually within one business day.
[**Describe your problem **→](https://app369.com/contact/) [**All fixes**](https://app369.com/fix/)