FirebaseDatabaseAuth

Firebase: Missing or insufficient permissions

FirebaseError: Missing or insufficient permissions.

In short: Your Firestore (or Storage / Realtime Database) security rules don't allow this read or write.

Why it happens

Projects created in production mode deny everything by default, and test-mode rules expire after a set date. Other causes: the user isn't signed in yet when the query runs, the rule checks a field the document doesn't have, or a query asks for more documents than the rule permits (rules aren't filters, so the whole query fails).

How to fix it

1. Open Firebase console → Firestore → Rules and read what's actually deployed.
2. Write rules that allow each user to access only their own data, using request.auth.uid.
3. Wait for auth before querying: run queries inside onAuthStateChanged once the user exists.
4. Make your query constraints match the rule (for example where('ownerId', '==', uid) if the rule checks ownerId).
5. Use the Rules Playground in the console to test the exact request.

Example

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId}/{document=**} {
      allow read, write: if request.auth != null && request.auth.uid == userId;
    }
  }
}

Copy-paste fix prompt

I'm getting this error in my app:

FirebaseError: Missing or insufficient permissions.

[Paste the full error, stack trace, and the file it points to here]

Likely cause: Your Firestore (or Storage / Realtime Database) security rules don't allow this read or write.

Task: Read my current Firestore rules and the failing query. Write the narrowest rules that allow this user to do this operation on their own data, and adjust the query so it matches the rules.

Rules:
- First explain the root cause in 2 sentences and list the files you'll change.
- Make the smallest change that fixes it. Don't refactor unrelated code.
- Don't disable security or checks (RLS, auth, signature verification, type checking, CORS allow-all) to make the error disappear.
- Never print or hard-code secret keys.
- Finish by telling me exactly how to verify the fix.

Common with: Cursor, Bolt, Replit. Last reviewed 2026-11-13.