Firebase "HTTP Error: 403, The caller does not have permission" in CI

By Kaveh Alemi·Latchkey

The CLI authenticated successfully, but the identity lacks the IAM permission for this action. 403 is authorization, not authentication: the token is valid, the role is missing.

What this error means

A deploy step fails with "Error: HTTP Error: 403, The caller does not have permission" while less privileged operations may still work.

Error: HTTP Error: 403, The caller does not have permission

Common causes

The service account is missing a required role

Deploying hosting, functions, or rules each needs specific IAM roles. Without them the API returns 403 even with a valid token.

A newly created service account with no bindings

A fresh service account has no project roles until you grant them, so every write is forbidden.

How to fix it

Grant the needed IAM roles

1. Identify which resource the 403 came from (hosting, functions, firestore).
2. Grant the service account the matching role in project IAM, for example Firebase Hosting Admin or Cloud Functions Admin.
3. Re-run the deploy.

gcloud projects add-iam-policy-binding my-project \
  --member="serviceAccount:ci@my-project.iam.gserviceaccount.com" \
  --role="roles/firebasehosting.admin"

Use the Firebase Admin role for broad deploys

If the job deploys several products, the Firebase Admin role covers most Firebase resources; narrow it later.

How to prevent it

• Grant the CI service account the exact roles each deploy needs.
• Add the Service Account User role if deploying functions that run as another account.
• Review IAM bindings when adding a new Firebase product to the deploy.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation