Firebase Rate Limit & Auth Errors: Fix 401, 403, 429, 502, 503 and Token Issues

Understanding Firebase Rate Limit and Auth Errors

Firebase surfaces a family of HTTP and SDK-level errors that share overlapping root causes. Before reaching for a fix, identify the exact signal you are seeing:

• HTTP 429 / gRPC RESOURCE_EXHAUSTED — you have exceeded a Firebase or underlying Google Cloud quota.
• HTTP 401 / UNAUTHENTICATED — the request carried no credentials, an expired ID token, or a revoked service-account key.
• HTTP 403 / PERMISSION_DENIED — credentials are valid but Security Rules or IAM policies deny the operation.
• HTTP 502 / HTTP 503 — Firebase's backend is temporarily unavailable; a transient condition.
• auth/id-token-expired, firebase invalid token — the JWT issued by Firebase Auth has passed its one-hour TTL without a refresh.
• auth/network-request-failed, firebase connection refused — a network layer problem between your client and Firebase endpoints.
• firebase authentication failed — a broad SDK message; usually wraps one of the above.

Step 1: Identify the Error Source

1a. Check the Firebase Console

1. Open Firebase Console → Project → Usage and billing.
2. Under Firestore, look for spikes in Reads, Writes, or Deletes approaching daily free-tier limits (50 k reads / 20 k writes / 20 k deletes per day on Spark).
3. Under Authentication, check sign-in attempts — Firebase enforces per-IP and per-project thresholds to prevent credential stuffing.
4. Under Realtime Database, verify concurrent connections (100 on Spark, 200 k on Blaze).

1b. Read the Raw Error in Your Logs

Firebase Admin SDK (Node.js) errors contain a code and message:

FirebaseError: [code=resource-exhausted]: Quota exceeded: FirestoreReads
FirebaseError: [code=unauthenticated]: Request had invalid authentication credentials.
FirebaseError: [code=permission-denied]: Missing or insufficient permissions.

Firebase client SDK errors surface on the rejected Promise or onError callback:

code: 'auth/id-token-expired'
code: 'auth/network-request-failed'
code: 'permission-denied'

Step 2: Fix firebase rate limit (HTTP 429 / RESOURCE_EXHAUSTED)

2a. Implement Exponential Backoff

Firebase client SDKs do not retry automatically on 429. Add a helper:

async function withRetry<T>(fn: () => Promise<T>, maxAttempts = 5): Promise<T> {
  for (let attempt = 0; attempt < maxAttempts; attempt++) {
    try {
      return await fn();
    } catch (err: any) {
      const isRetryable =
        err.code === 'resource-exhausted' ||
        err.code === 'unavailable' ||
        [429, 502, 503].includes(err.status);
      if (!isRetryable || attempt === maxAttempts - 1) throw err;
      const delay = Math.min(1000 * 2 ** attempt + Math.random() * 200, 30000);
      await new Promise(r => setTimeout(r, delay));
    }
  }
  throw new Error('Unreachable');
}

2b. Shard Hot Documents

Firestore limits a single document to roughly 1 write/second sustained. If you are incrementing a counter:

// BAD: single document counter
await db.doc('stats/global').update({ views: FieldValue.increment(1) });

// GOOD: distributed counter with 10 shards
const shardId = Math.floor(Math.random() * 10);
await db.doc(`stats/global/shards/${shardId}`).update({ views: FieldValue.increment(1) });

2c. Request a Quota Increase

For persistent Blaze-plan projects: GCP Console → APIs & Services → Firebase APIs → Quotas — select the specific quota and click Edit Quotas.

Step 3: Fix firebase 401 / firebase unauthorized / firebase token expired

3a. Client-Side: Force-Refresh the ID Token

Firebase ID tokens expire after 3600 seconds. Force a refresh:

import { getAuth } from 'firebase/auth';

async function getFreshToken(): Promise<string> {
  const user = getAuth().currentUser;
  if (!user) throw new Error('No authenticated user');
  // Pass true to force a network round-trip to refresh
  return user.getIdToken(/* forceRefresh */ true);
}

Attach the fresh token to outgoing requests:

const token = await getFreshToken();
const res = await fetch('https://your-api.example.com/data', {
  headers: { Authorization: `Bearer ${token}` },
});

3b. Server-Side Admin SDK: Rotate the Service Account Key

# List existing keys
gcloud iam service-accounts keys list \
  --iam-account=firebase-adminsdk-XXXXX@PROJECT_ID.iam.gserviceaccount.com

# Create a new key
gcloud iam service-accounts keys create new-key.json \
  --iam-account=firebase-adminsdk-XXXXX@PROJECT_ID.iam.gserviceaccount.com

# Invalidate the old key (replace KEY_ID)
gcloud iam service-accounts keys delete KEY_ID \
  --iam-account=firebase-adminsdk-XXXXX@PROJECT_ID.iam.gserviceaccount.com

Update your environment:

export GOOGLE_APPLICATION_CREDENTIALS=/path/to/new-key.json
# Or in your CI/CD secret store:
kubectl create secret generic firebase-key --from-file=key.json=new-key.json --dry-run=client -o yaml | kubectl apply -f -

Step 4: Fix firebase 403 / PERMISSION_DENIED

4a. Test Security Rules in the Simulator

Firebase Console → Firestore → Rules → Rules Playground. Simulate the failing read/write with the exact UID and document path from your logs. Common mistakes:

// Overly restrictive — blocks all reads
rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if false; // <--- THIS blocks everything
    }
  }
}

A correct authenticated-user read rule:

allow read: if request.auth != null && request.auth.uid == resource.data.ownerId;

4b. Verify IAM Roles (Admin SDK)

# Check roles on the service account
gcloud projects get-iam-policy PROJECT_ID \
  --flatten="bindings[].members" \
  --filter="bindings.members:serviceAccount:firebase-adminsdk*" \
  --format="table(bindings.role)"

The Admin SDK service account needs at minimum roles/firebase.admin or the granular roles/datastore.user.

Step 5: Fix firebase 502 / firebase 503 / firebase connection refused

These errors indicate transient Firebase infrastructure issues. Verify at status.firebase.google.com first. If the incident is active, wait it out with backoff. If no incident is listed:

1. Check DNS resolution: nslookup firestore.googleapis.com — should return multiple Google IPs.
2. Check TLS: openssl s_client -connect firestore.googleapis.com:443 -brief — should complete the handshake.
3. Check egress firewall rules — Firebase requires outbound TCP 443 to *.googleapis.com and *.firebaseio.com.
4. Emulator conflict: if running Firebase Emulator locally, ensure FIREBASE_EMULATOR_HOST is not set in production environments.

Step 6: Enable App Check to Prevent Abuse-Driven Rate Limiting

If your project is public-facing and you are being rate limited by bots, enable App Check:

import { initializeApp } from 'firebase/app';
import { initializeAppCheck, ReCaptchaV3Provider } from 'firebase/app-check';

const app = initializeApp(firebaseConfig);
initializeAppCheck(app, {
  provider: new ReCaptchaV3Provider('YOUR_RECAPTCHA_SITE_KEY'),
  isTokenAutoRefreshEnabled: true,
});

In Security Rules, enforce App Check:

allow write: if request.auth != null && request.app.token.valid;