FixesFirebase errors and fixes
Auth and Google sign-in, Firestore rules, indexes and quotas, Cloud Functions, Storage, App Check and push notifications. Each page is checked against Firebase’s own docs and says what to try first.
19 Firebase fixes. Also see Firebase Security Rules checker, Backend development and Flutter development.
- Firebase and Google Cloud billingUnexpected Gemini API charges on a Firebase projectStop the spend first: in the Google Cloud console, check the API metrics to see which key made the calls, then rotate it and restrict or delete every API key that allows the Generative Language API and isn’t a server-side Gemini key. If you can’t find the key fast, you can disable billing on the project, after checking what that takes down. Then move Gemini calls behind your server, turn on App Check for the Firebase services your app uses, set spend cap budgets where Firebase supports them, and keep an alert budget on the whole project. Budget alerts only warn you; they don’t stop charges.
- Firebase Firestore errorFirebaseError: Missing or insufficient permissionsUsually the query asks for more than the rules allow. Firestore rules are not filters: if a query could return even one document the user can’t read, the whole query fails. Add the same conditions to the query that the rule checks. Next most likely: no user is signed in yet when the request runs.
- Firebase security alertFirebase says your Cloud Firestore database isn’t properly securedYour rules let people read or write data they shouldn’t, commonly test-mode rules left on after launch, or rules that only check that someone is signed in. Replace them with rules that check who owns each document, test them in the Rules Playground or the emulator, then deploy. Paste your rules into the free checker first to see which patterns you have.
- Firebase Firestore errorFAILED_PRECONDITION: The query requires an indexA query that combines a filter on one field with a sort or range on another needs a composite index, and Firestore doesn’t create those for you. The full error message includes a link that opens the Firebase console with the index filled in: create it, then wait for it to build (a few minutes at least, longer on big collections). Then add it to firestore.indexes.json and deploy it, so every project has it.
- Cloud Firestore quota errorWhy does Firestore say I exceeded my quota?On the free quota, Firestore allows 50,000 document reads, 20,000 writes and 20,000 deletes a day, reset around midnight Pacific time. Hitting the limit usually means something reads the same documents again and again: listeners that reconnect, queries with no limit, offsets, security rules that read other documents, or counting by downloading a whole collection. Check the Usage tab, fix the biggest source, or enable billing and set a budget alert, knowing a budget doesn’t cap usage.
- Firebase Authentication errorFirebase: Error (auth/unauthorized-domain)The domain your app runs on isn’t in Firebase’s Authorized domains list. In the Firebase console, go to Authentication, then Settings, then Authorized domains, and add the exact domain, such as app.example.com, without https:// or a path. Every preview URL counts as its own domain, and projects created after April 28, 2025 no longer include localhost.
- Firebase Authentication errorWhy does Firebase sign-in fail with auth/invalid-credential?With email enumeration protection on, which is the default for projects created on or after September 15, 2023, Firebase returns auth/invalid-credential for any invalid email or password, so your app can’t tell which one was wrong. Show one message such as “Email or password is incorrect”, stop branching on user-not-found and wrong-password, and make the forgot-password flow say an email was sent if the account exists. With protection on, a mistyped password gets the same code, so check the password too.
- Android sign-in errorWhy does Google Sign-In fail on Android with error 10?Status 10 means Google says the app is misconfigured. If sign-in works in debug but fails from Google Play, register the app signing key fingerprint from Play Console, not just your upload key. Add the debug fingerprint too, pass the Web client ID as the server client ID, and if you use Firebase, download the updated google-services.json after adding fingerprints.
- Firebase Cloud FunctionsFirebase Cloud Functions: blocked by CORS policyHTTP functions have no CORS policy by default, so browsers block calls from other sites. Set the cors option on the function to your app’s domains, or to true only for a public API. Callable functions allow all origins by default, so a CORS error there often means the request never reached your code: check the function name, region and deploy before touching CORS.
- Firebase Cloud Functions errorWhy does firebase deploy fail for my Cloud Functions?Read the error’s first line and match it: deploying functions needs the Blaze plan; Node.js 14 and 16 can no longer be deployed; “could not build the function” is often a permission problem on the build service account; “Container Healthcheck failed” means the code failed to start and listen for requests; and 429 or 500 errors on a big deploy mean you deployed a large number of functions at once. Fix that one cause and deploy again.
- Firebase Cloud Functions errorWhy is my Firebase Cloud Function running out of memory?Firebase says 2nd gen functions are powered by Cloud Run, and Google’s Cloud Run docs say a container instance that uses too much memory is terminated, with a log message saying you may have a memory leak or may need more memory. Check the Memory usage plot for the function in the Google Cloud console, then raise the memory option in code if it really needs more, delete files you write to the temporary directory (they count as memory), and stream large files instead of loading them whole.
- Firebase App CheckFirebase App Check is blocking my app’s requestsOnce App Check is enforced, every request without a valid App Check token is rejected. Localhost and CI need a debug token registered in the console, older app versions without the App Check SDK fail until users update, and enforcement can take up to 15 minutes to apply. Check the App Check metrics before enforcing, and keep it on.
- Firebase Auth errorFirebase: auth/requires-recent-login when deleting an accountDeleting an account, setting a primary email address and changing a password need a recent sign-in. If the user signed in too long ago, Firebase fails the action with auth/requires-recent-login. Ask the user to sign in again, pass the new credential to reauthenticateWithCredential, then retry the action. Account deletion can also run on your server with the Admin SDK, which deletes users by uid.
- Firebase Storage errorFirebase Storage “storage/unauthorized” errorYour Cloud Storage Security Rules rejected the request. Check three things: the rules allow this action for this user, the user is signed in before the upload starts, and the file path matches the path in the rule, such as a folder named after the user’s uid. Don’t fix it by allowing everyone: Firebase strongly recommends restricting access.
- Firebase Cloud Messaging errorFCM “messaging/registration-token-not-registered” (UNREGISTERED, 404)The device token you sent to is no longer valid: the app was uninstalled, the token expired or was refreshed, or the app unregistered. Firebase says to delete that token from your server and stop sending to it. Then make sure the app sends its current token to your server every time it gets one, so each user has a fresh token on file.
- Firebase Auth errorFirebase “auth/too-many-requests”Firebase refused the request because a request limit was exceeded. New accounts are limited per IP address, and SMS codes are limited per IP address and per phone number. During testing, use fictional phone numbers from the Firebase console and stop scripts that create accounts in a loop; for real users, wait and retry later.
- Firebase Auth errorFirebase Google sign-in fails with “auth/popup-blocked” on the live siteBrowsers only allow a popup that opens right after a click. If your code awaits something (loading config, a network call) before signInWithPopup, the click may no longer count, and the browser can block the popup. Call signInWithPopup first thing in the click handler, or use signInWithRedirect, following Firebase’s redirect best practices.
- Flutter and Firebase errorFlutter: “No Firebase App ‘[DEFAULT]’ has been created”Call WidgetsFlutterBinding.ensureInitialized(), then await Firebase.initializeApp() with DefaultFirebaseOptions.currentPlatform, all before runApp. If the crash happens when a message arrives in the background, call Firebase.initializeApp() inside the background message handler too, as Firebase’s own example does.
- Firebase Auth errorFirebase “auth/operation-not-allowed”The sign-in provider your code calls is disabled for this Firebase project. In the Firebase console, open Security, then Authentication, then the Sign-in method tab, and enable the provider: Email/Password, Email link, Phone, Anonymous or a social provider. For email link sign-in, Email/Password must be on as well.
Looking for another platform? See every fix.
A different Firebase error?
Describe it and get a written quote
Send the error and what you were doing. You get a written scope, a fixed price and a timeline; we reply by email, usually within one business day.