Firebase Functions errorFirebase Functions: 403 Forbidden, the request was not authenticated

Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.

Why Cloud Run refuses the call, and the fix

1. 01

   The function isn’t public

   “Invoker to set access control on https functions.” Firebase, HttpsOptions.invoker

   A 2nd gen function runs on Cloud Run, which checks who may call it. Set invoker on the function so the deploy grants public access, and deploy again.

   import { onRequest } from 'firebase-functions/v2/https';
   
   export const webhook = onRequest({ invoker: 'public' }, async (req, res) => {
     // check a signature or secret here: anyone can call a public URL
     res.send('ok');
   });

2. 02

   The deploy couldn’t make it public

   If the deploy output says it could not set the IAM policy for the function, an organization policy on the Google Cloud project may block public access, or the account running firebase deploy may lack permission to change who can invoke the service. The function then deploys but stays private. An admin has to allow it, or callers must authenticate.

3. 03

   A private function is called without a token

   “HTTP 403: The request was not authenticated. Either allow public access or set the proper Authorization header” Google Cloud, Cloud Run troubleshooting

   Cloud Scheduler, Cloud Tasks, another service or a script must send an ID token for an account with the Cloud Run Invoker role. Configure an OIDC token on the scheduler job or task, or fetch one in your server code. To test, call the URL with curl and an Authorization: Bearer header set to the output of gcloud auth print-identity-token. If that works and a plain call gets 403, the function is private.

4. 04

   The token’s account lacks the role

   “If a service account invokes your service, ensure that the service account is a member of the Cloud Run service, and grant the Cloud Run Invoker (roles/run.invoker) role.” Google Cloud, Cloud Run troubleshooting

   A valid token still fails if its account can’t invoke the service. Grant Cloud Run Invoker to that service account on the function’s Cloud Run service.

Checked against the vendor’s docs on November 9, 2026: Firebase reference: HttpsOptions (invoker); Google Cloud: Cloud Run troubleshooting.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

• from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
• from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start

Related: Firebase Functions CORS error · Firebase Functions deploy failed · Firebase App Check blocking requests · Firebase callable INTERNAL error