storage/unauthorized: User does not have permission to access Google Cloud / Firebase Origin: Platform & cloud OSI layer 7 · Application Last updated 4 Nov 2026

Firebase Storage: Firebase Storage: User does not have permission to access 'images/photo.jpg'. (storage/unauthorized)

Firebase Security Rules for Cloud Storage denied the request for this path and user.

Exact message you may see Firebase Storage: User does not have permission to access (storage/unauthorized)storage/unauthenticated User is not authenticatedFirebase Storage: User is not authenticatedstorage/object-not-found Firebase Storage
Explore the map of this error Full error map →
Seen on: Google Cloud JavaScript

Meaning

Rules decide access: check storage.rules for the path and condition (request.auth != null), make sure the user is signed in, the path matches your match block, and rules were deployed. Test in the Rules Playground. Also check that the bucket URL in the SDK matches the project.

Common causes

  • Not signed in but rules require auth
  • Rules path mismatch
  • Rules not deployed
  • Wrong bucket in the config
  • Size or content-type conditions in rules failing

⚡ Quick fix

  1. Read and fix storage.rules; deploy with firebase deploy --only storage
  2. Sign in before upload/download
  3. Use the Rules Playground to simulate

Detailed fix by platform

Firebase

  1. firebase deploy --only storage

Code examples

storage.rules

text
rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /images/{userId}/{file} {
      allow read: if true;
      allow write: if request.auth != null && request.auth.uid == userId;
    }
  }
}

How to diagnose

  1. Auth — Signed in?
  2. Rules — Match the path?
  3. Deploy — Latest rules?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

403: does not have storage.objects.get access — Cloud Storage: 403 Forbidden — user@example.com does not have storage.objects.get access to the Google Cloud Storage object (Google Cloud / Firebase)403: does not have st…auth/invalid-credential — Firebase Auth: auth/invalid-credential (auth/wrong-password, auth/user-not-found, auth/invalid-login-credentials) (Authentication)auth/invalid-credenti…CORS: No Access-Control-Allow-Origin (Cloud Storage) — Browser: Access to fetch at 'https://storage.googleapis.com/bucket/file' from origin 'https://app.example.com' has been blocked by CORS policy (Google Cloud / Firebase)CORS: No Access-Contr…Error 403: API has not been used in project (Terraform) — Terraform: Error: Error creating Network: googleapi: Error 403: Compute Engine API has not been used in project 123 before or it is disabled (Terraform)Error 403: API has no…FailedMount — Pod stuck ContainerCreating: MountVolume.SetUp failed / Unable to attach or mount volumes: timed out waiting for the condition (Kubernetes)FailedMountFirebase CLI: Authentication Error: Your credentials are no longer valid — Firebase CLI: Error: Authentication Error: Your credentials are no longer valid. Please run firebase login --reauth (Google Cloud / Firebase)Firebase CLI: Authent…Firebase Hosting: Page Not Found on refresh (SPA routes) — Firebase Hosting: Page Not Found — This file does not exist and there was no 404.html or index.html found in the document root (Google Cloud / Firebase)Firebase Hosting: Pag…Firebase: Your project must be on the Blaze (pay-as-you-go) plan — Firebase CLI: Error: Your project my-app must be on the Blaze (pay-as-you-go) plan to complete this command. Required API cloudbuild.googleapis.com can't be enabled until the upgrade is complete (Google Cloud / Firebase)Firebase: Your projec…storage/u…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.