Firebase-functions: Getting metadata from plugin failed with error: invalid_grant

[imarian97]

Version info

firebase-functions: 0.7.1

firebase-tools: 3.13.1

firebase-admin: 5.4.2

Test case

Trying to get a firestore doc in HTTP cloud functions returns this error in the local emulator (firebase serve --only functions)

error: Auth error:Error: invalid_grant
error: { Error: Getting metadata from plugin failed with error: invalid_grant
    at ClientReadableStream._emitStatusIfDone (C:\Users\imari\Desktop\PROJECTS\dance-reg\functions\node_modules\firebase-admin\node_modules\grpc\src\node\src\client.js:255:19)
    at ClientReadableStream._receiveStatus (C:\Users\imari\Desktop\PROJECTS\dance-reg\functions\node_modules\firebase-admin\node_modules\grpc\src\node\src\client.js:233:8)
    at C:\Users\imari\Desktop\PROJECTS\dance-reg\functions\node_modules\firebase-admin\node_modules\grpc\src\node\src\client.js:705:12 code: 16, metadata: Metadata { _internal_repr: {} } }

Steps to reproduce

1. Init a new firebase functions project with this index.js

const functions = require('firebase-functions');
const admin = require('firebase-admin');
admin.initializeApp(functions.config().firebase);
var db = admin.firestore();

exports.myFunc= functions.https.onRequest((req, res) => {
    return db.doc("athletes/1").get().then(doc=>{
        if(doc.exists){
            console.log(doc.data());
            res.send(doc.data())
        }
    }).catch(err=>{
        console.error(err);
    });
});

1. Enable firestore in firebase console with public acces security rules:

service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write;
    }
  }
}

1. Serve

firebase serve --only functions

1. Test

 curl -X GET "http://localhost:5000/my-test-project/us-central1/myFunc"

Were you able to successfully deploy your functions?

Yes, the deploy is successful. The issue appears only locally.

Expected behavior

The expected behavior is to log the firestore document in the console and send it as an HTTP response.

Actual behavior

The get() promise is rejected with the above mentioned error.

[laurenzlong]

@imarian97 Can you run

cd ~/.config/gcloud
ls 

if there's a file called application_default_credentials.json, remove it by running:

rm application_default_credentials.json

[imarian97]

I'm on Windows but I've found the file in %appdata%/gcloud and now, after I removed the file, it works.

Thanks!

[laurenzlong]

Great! Thanks for the update.

[TheRoccoB]

Forgive me for asking, but what did this actually do? It worked for me as well. I think I upgraded firebase_tools at some point, and I've also been switching between dev & prod environments a bit.

It looks like application_default_credentials.json is recreated when I restart the local server?

[laurenzlong]

@TheRoccoB Yes it does get recreated when you run the local server. If the file already exists, then the Firebase CLI will not create one. Since an existing file (created by gcloud CLI or an older firebase CLI) may not have adequate access levels, you may encounter issues when trying to access certain features. Deleting it manually allows Firebase CLI to re-create the file with credentials that have the access levels you need. We are working to change the way credentials work in the local emulator so problems like this won't occur.

[TheRoccoB]

Thanks for the response Lauren.

[alexbjorlig]

I got this error when running the shell, but was resolved by deleting the file.

[kylehotchkiss]

I'm encountering this error on Firebase Functions on Google's side. I can't figure it out 😭. I tried deleting and repushing function but no luck.

[raDiesle]

same here. First time I encounter error today, so not local, but on google deployed server.

I sent bug report to google

[sionfletcher]

@kylehotchkiss @raDiesle getting the same thing here, cloud functions no longer work

Auth error:Error: Could not refresh access token.
awa | Error: 16 UNAUTHENTICATED: Getting metadata from plugin failed with error: Could not refresh access token. at createStatusError (/user_code/node_modules/firebase-admin/node_modules/grpc/src/client.js:65:15) at ClientReadableStream._emitStatusIfDone (/user_code/node_modules/firebase-admin/node_modules/grpc/src/client.js:271:19) at ClientReadableStream._receiveStatus (/user_code/node_modules/firebase-admin/node_modules/grpc/src/client.js:249:8) at /user_code/node_modules/firebase-admin/node_modules/grpc/src/client.js:715:12
-- | --

[kylehotchkiss]

@raDiesle @sionfletcher i mailed firebase's technical support, hopefully that will get their attention

[kylehotchkiss]

@laurenzlong Hi Lauren, Any chance you could flag this on Google's end?

Additionally, SO users filing: https://stackoverflow.com/questions/48550151/after-deploy-cloud-functions-error-could-not-refresh-access-token

[Mph1399]

@kylehotchkiss -I'm getting the same issue after a deploy today. The same code was working last night. I don't have an application_default_credentials.json file to remove as suggested above so I'm not sure what else to do but maybe wait for a fix from Firebase?

[kylehotchkiss]

Might be good to add those to Firebase's bug form: https://firebase.google.com/support/contact/bugs-features/

[raDiesle]

I sent quick Firebase bug form with category: cloud functions

[moneal]

I've had a support request in for a couple hours and no reply yet or official word in Slack yet.

[Mph1399]

I just got a Firebase ticket response saying:
"Hi there,

Thanks for reaching out. We're currently investigating the issue with refreshing Authentication token. We'll get back to you as soon as we have more information to share."

[moneal]

Issue is now being tracked on the status page https://status.firebase.google.com/incident/Functions/18011

[rjhuijsman]

Thanks everyone for the reports, both here and especially also via our tech support channels - these really help.

We believe the issue to have been caused by a problem deep in our Node.js dependency chain, in particular for users of Firestore. We've just released https://www.npmjs.com/package/google-gax 0.14.5 to address the issue. Please:

• Either wait for the npm caches to pick up the new version, or explicitly request google-gax 0.14.5 in your package.json.
• Re-deploy your functions.

That should resolve things. If you're still having trouble, please let us know!

[sionfletcher]

Thanks, @rjhuijsman, works for me

[FrozenPandaz]

I still seem to be having issues, i have installed [email protected] but i still get that error when running firebase serve

[pcnate]

I randomly find the same issue on [email protected] with [email protected]
Removing the ~/.config/gloud/application_default_credentials.json temporarily resolves the issue

[m0ngr31]

Seems to solve the issue @rjhuijsman. Thanks.

[jpagex]

I am still having the issue.
I tried several things:

• Installing [email protected]
• Removing functions, disabling Cloud Functions API and redeploying the functions

It keeps failing.

Any solution?

[laurenzlong]

@jpagex It's hard to diagnose without more information.

1) If you are seeing this when EMULATED functions: update firebase-tools to latest, then try again. This was a resolved bug. If that doesn't work, then file an issue on https://github.com/firebase/firebase-tools
2) If you are seeing this in DEPLOYED functions, file a support ticket at firebase.google.com/support

[ptyagicodecamp]

@laurenzlong Removing application_default_credentials.json didn't solve issue for me. I don't see this file regenerating either.

I seem to get stuck at this error:

Error: Could not load the default credentials. Browse to https://cloud.google.com/docs/authentication/getting-started for more information.

packages.json

{
  "name": "functions",
  "scripts": {
    "lint": "tslint --project tsconfig.json",
    "build": "tsc",
    "serve": "npm run build && firebase serve --only functions",
    "shell": "npm run build && firebase functions:shell",
    "start": "npm run shell",
    "deploy": "firebase deploy --only functions",
    "logs": "firebase functions:log"
  },
  "engines": {
    "node": "8"
  },
  "main": "lib/index.js",
  "dependencies": {
    "firebase-admin": "^8.2.0",
    "firebase-functions": "^3.0.2",
    "firebase-tools": "^7.0.2",
    "google-gax": "^1.1.3"
  },
  "devDependencies": {
    "tslint": "^5.12.0",
    "typescript": "^3.2.2"
  },
  "private": true
}

Am I missing something?

[asanre]

I had the same problem.I tried several things:

• Installing [email protected]
• Removing functions, disabling Cloud Functions API and redeploying the functions

but It didn´t work. the way to solved it for me was installing cloud sdk and after that execute gcloud auth application-default login to generate again the ADC.

[flauc]

Thank you @asanre this did it for me.

[mdunisch]

@asanre great, reauth with the gcloud cli worked for me!

[marcklingen]

@asanre Thanks a lot for the hint! Worked for me as well.

[impulse]

one-liner for macOS / Linux

rm ~/.config/gcloud/application_default_credentials.json && gcloud components update && gcloud auth application-default login

[danielsig]

@asanre You saved me man! Thanks!

[megane42]

I just forgot executing below after rebooting mac...

export GOOGLE_APPLICATION_CREDENTIALS="/home/user/Downloads/service-account-file.json"

(c.f. https://firebase.google.com/docs/admin/setup#initialize_the_sdk)