41

I updated the Firebase SDKs of my Firebase for Web application.
Since the update my application no longer starts and throws the following error:
Any idea what is going on?

Uncaught (in promise)
FirebaseError: Installations: Create Installation request failed with error "403 PERMISSION_DENIED: Requests to this API firebaseinstallations.googleapis.com method google.firebase.installations.v1.FirebaseInstallationsService.CreateInstallation are blocked." (installations/request-failed).

Frank van Puffelen
  • 565,676
  • 79
  • 828
  • 807
Andreas Rayo Kniep
  • 5,674
  • 2
  • 30
  • 30

1 Answers1

140

It turns out that new versions of Firebase SDKs depend on a new internal infrastructure service, called FIS (the Firebase Installations Service) for targeting identifiers ("FIDs" or "Instance-IDs").
If you are using API key restrictions for the API keys you use in your application, you will have to extend those restrictions to allow usage with the new Firebase Installations Service at firebaseinstallations.googleapis.com.

To allow your API key in question to be used with the new Firebase Installations API:

  • go to the Google Cloud Console
  • choose the relevant project (i.e. the project you use for your application)
  • open the menu and go to APIs & Services -> Credentials
  • click Edit API key for the API key in question
  • scroll down to API restrictions
  • from the dropdown, choose Firebase Installations API
  • click Save
  • wait a couple of minutes for Google servers to update and retry...

Note: If you cannot find the Firebase Installations API in the list of APIs, you might first have to enable the API for your project (to do so click here).

Note: If you are not sure which API key is used in your application, you can check the usage numbers of Firebase Installations API per API key.

Note: Verify your fix by checking if you can see successful 200 requests increasing on the Firebase Installations API request metrics page.

Test if your configuration works with the following CURL command:

api_key=<YOUR_API_KEY>
project_identifier=<YOUR_PROJECT_ID>
app_id=<YOUR_FIREBASE_APP_ID_SIMILAR_TO_1:12345678:android:00000aaaaaaaa>

curl -H "content-type: application/json" -d "{appId: '$app_id', sdkVersion: 't:1'}" https://firebaseinstallations.googleapis.com/v1/projects/$project_identifier/installations/?key=$api_key

If your API key uses App restrictions you will have to expand your CURL request with the respective HTTP headers identifying your application:

  • Android: -H "x-android-package: com.rayo.example.app" -H "x-android-cert: 1234567890ABCDEF1234567890ABCDEFAABBCCDD"
  • iOS: -H "x-ios-bundle-identifier: com.rayo.example.app"
  • Webapp: -H "Referer: https://www.your.webapp.com/page?p=1"
Andreas Rayo Kniep
  • 5,674
  • 2
  • 30
  • 30
  • 2
    Can you update your cloud console link to a correct link? – Christiaan Maks Dec 17 '19 at 15:24
  • 2
    I have no restriction on API's but this issue exists then I have select all API's in restrictions still issue persists when I downgrade firebase SDK to 20.1.0 it works. I know it is not a good solution but nothing other than this is helping me. – rana_sadam Apr 07 '20 at 05:15
  • @rana_sadam: (Q1) What is your exact error message? (Q2) Have you checked if you are looking at the right API key? The [credentials usage page](https://console.cloud.google.com/apis/api/firebaseinstallations.googleapis.com/credentials) shows which API key is used when sending requests to the `Firebase Installations API`. (Q3) Can you see the `Firebase Installations API` in the dropdown list of APIs below `API restrictions`? If not, you have to [enable it for your project](https://console.cloud.google.com/apis/library/firebaseinstallations.googleapis.com) first. – Andreas Rayo Kniep Apr 11 '20 at 07:25
  • 2
    @AndreasRayoKniep i did all steps following your instruction but still receiving 403 PERMISSION_DENIED. I can not understand, can u help me out? – Shaw Nov 20 '20 at 09:56
  • @Shaw, I had the same problem. On mi Google Console -> Credentials Dashboard I have two API credentials, 1 for Android Google Maps and another one autogenerated by Firebase. I updated both, enabling the Firebase Installations API Restriction in both. That solve my problem! – markomoreno Dec 13 '20 at 21:04
  • I'm having the same problem as @Shaw, updated ALL APIS restrictions months ago and still having that issue. Luckily fallback to measurementID on config is working. – Matt Costa Jan 14 '21 at 19:45
  • it worked, we need to wait for atleast 5 to 10 minutes. – Abhishek Garg Jan 26 '21 at 15:01
  • In the Cloud Platform console I'm getting around 25% failure of CreateInstallation error code 403. I'm using one API Credential without restrictions, anyone knows what's wrong? – Eric Jan 31 '21 at 14:14
  • I have 3 project, on one there is also google maps api sdk enabled and is working fine. The bad thing is that I messed up all the user authorizations of service accounts on all the 3 project so I am getting 98% of 403 errors on all the 3. How can I reset the original user permission of service accounts? – Phantom Lord Feb 23 '21 at 17:33
  • 1
    I edited my response and added a CURL command in the answer that should help you debug your configuration outside of your application. If you are using a valid configuration and you are not using IP restrictions or App restrictions, the CURL command should succeed for you. | You just have to make sure that the API key you are testing is the same API key that your application is actually using. Some `google-services.json` files contain multiple API keys! – Andreas Rayo Kniep Mar 02 '21 at 01:09
  • @AndreasRayoKniep could you modify the CURL command to make it possible to return valid response when App restrictions are enabled? I couldn't find a single piece of documentation of this API :( – javaxian Mar 15 '21 at 13:08
  • 1
    @javaxian : Done, I edited my response. For each platform you will have to set different headers to identify your application against App restrictions, i.e. iOS (`x-ios-bundle-identifier`), Android (`x-android-package` and `x-android-cert`), Web (`Referer`). – Andreas Rayo Kniep Mar 17 '21 at 22:18
  • 1
    Adding Firebase Installation API to API restriction in Google console resolved by issue. Thank you ! – Shailesh Sep 27 '21 at 06:45
  • I get error 400 when i use the curl stating that "API key not valid. Please pass a valid API key." But it is the one in the cloud console. I have restricted it to Android apps and I also provided headers for sha-1 and package name. – Erkan GÖRGÜLÜ May 05 '22 at 15:31