Firebase "HTTP Error: 401, Request had invalid authentication credentials" in CI

By Daniel Zoghalchali·Latchkey

A Google API returned 401: the credential the CLI sent was invalid, expired, or malformed. The request reached the server; the token itself was rejected before any permission check.

What this error means

A deploy or API call fails with "Error: HTTP Error: 401, Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential."

Error: HTTP Error: 401, Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential.

Common causes

An expired or malformed token

A stale FIREBASE_TOKEN or a truncated service account key produces a credential the API cannot validate, returning 401.

GOOGLE_APPLICATION_CREDENTIALS points at a bad file

If the key file is empty, partially written, or the wrong JSON, the CLI cannot mint a valid access token.

How to fix it

Write the key file correctly and verify it

1. Confirm the secret contains the full, valid service account JSON.
2. Write it to a file and check it parses before deploying.
3. Set GOOGLE_APPLICATION_CREDENTIALS to that path.

echo '${{ secrets.FIREBASE_SERVICE_ACCOUNT }}' > gcp-key.json
python -c "import json,sys; json.load(open('gcp-key.json'))"
export GOOGLE_APPLICATION_CREDENTIALS=$PWD/gcp-key.json

Replace a deprecated token flow

Stop using FIREBASE_TOKEN from firebase login:ci; authenticate with a service account key instead.

How to prevent it

• Validate the service account JSON parses before running the deploy.
• Prefer service account auth over long-lived CI tokens.
• Rotate credentials and update the secret in one place.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation