Firestore Missing or Insufficient Permissions (permission-denied)

How to fix it

Try these in order — the most common fix is first.

1. 1. Check whether test-mode rules expired

   Copy steps
   1. Open Firebase console > Firestore Database > Rules
   2. Look for a request.time < timestamp.date(...) condition
   3. If the date is in the past, replace the whole rule with authentication-based rules instead of just moving the date
   Did this fix it? Yes No

2. 2. Write auth-based rules

   Copy steps
   1. Start from: match /users/{uid} { allow read, write: if request.auth != null && request.auth.uid == uid; }
   2. Publish the rules and wait up to a minute for new queries (up to 10 minutes for active listeners)
   Did this fix it? Yes No

3. 3. Test in the Rules Playground

   Copy steps
   1. In Rules, click Rules Playground
   2. Simulate get, list, create, update and delete, with and without an authenticated user
   3. Simulations run against the editor ruleset, not the deployed one, so publish after fixing
   Did this fix it? Yes No

4. 4. Make the query match the rule

   Copy steps
   1. If the rule says resource.data.ownerId == request.auth.uid, add the same where('ownerId','==',uid) to the query
   2. Use the Local Emulator Suite for unit-testing rules
   Did this fix it? Yes No

5. 5. Avoid rule overwrites

   Copy steps
   1. Keep firestore.rules in your repo and deploy only with firebase deploy --only firestore:rules
   2. Console edits are lost when the CLI deploys
   Did this fix it? Yes No

Symptoms

FirebaseError: Missing or insufficient permissions, or code permission-denied, on reads, writes or listeners. Often everything worked for the first 30 days, then stopped.

Why it happens

• Test-mode rules contain a request.time expiry and the date passed
• User is not signed in or the auth token is stale
• Rules are not filters: the query asks for more documents than the rule allows
• Rule evaluation touches another document you can't read (exists()/get() calls)
• Server SDK confusion: client rules apply only to client SDKs
• Rules were overwritten by a firebase deploy from another machine

This guide also covers

• firestore permission denied
• missing or insufficient permissions firebase
• firestore test mode expired
• firebase rules expired

Other Firebase errors

• Firebase auth/invalid-api-key Error
• Firebase auth/network-request-failed Error
• Firebase auth/too-many-requests Error
• Firebase auth/operation-not-allowed Error
• Firestore Quota Exceeded (resource-exhausted)
• Firebase Unexpected Bill on Blaze Plan
• Firebase Cloud Messaging Notifications Not Received
• Firebase Deploy Failed (Functions and Hosting)