GOOGLE_APPLICATION_CREDENTIALS is not working when used with firebase cli

[deepthi3shenoy]

[REQUIRED] Environment info

13.30.0

firebase-tools: 13.30.0

Platform: macOS

[REQUIRED] Test case

When GOOGLE_APPLICATION_CREDENTIALS is provided in environment variable and firebase command was tried it did not work but via token it is working

[REQUIRED] Steps to reproduce

set GOOGLE_APPLICATION_CREDENTIALS as environment variable to service account json file which has firebase app distribution admin permission. Load the zshrc file for the variable to be present
Run firebase projects:list in terminal > it does not work

Using below command it worked
firebase --token "$(./bin/gcloud auth application-default print-access-token)" projects:list

Even firebase command with app distribution is not working

[REQUIRED] Expected behavior

The firebase projects:list command should work with GOOGLE_APPLICATION_CREDENTIALS

[REQUIRED] Actual behavior

The firebase projects:list command is not working with GOOGLE_APPLICATION_CREDENTIALS

command requires scopes: ["email","openid","https://www.googleapis.com/auth/cloudplatformprojects.readonly","https://www.googleapis.com/auth/firebase","https://www.googleapis.com/auth/cloud-platform"]
[2025-02-10T14:40:04.869Z] Error: Invalid response body while trying to fetch https://www.googleapis.com/oauth2/v4/token: read ECONNRESET
at Gaxios._request (/Users/dshenoy/.cache/firebase/tools/lib/node_modules/gaxios/build/src/gaxios.js:149:19)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async GoogleToken._GoogleToken_requestToken (/Users/dshenoy/.cache/firebase/tools/lib/node_modules/gtoken/build/src/index.js:241:19)
at async GoogleToken._GoogleToken_getTokenAsync (/Users/dshenoy/.cache/firebase/tools/lib/node_modules/gtoken/build/src/index.js:160:16)
at async JWT.refreshTokenNoCache (/Users/dshenoy/.cache/firebase/tools/lib/node_modules/google-auth-library/build/src/auth/jwtclient.js:173:23)
at async JWT.refreshAccessTokenAsync (/Users/dshenoy/.cache/firebase/tools/lib/node_modules/google-auth-library/build/src/auth/oauth2client.js:247:19)
at async JWT.getAccessTokenAsync (/Users/dshenoy/.cache/firebase/tools/lib/node_modules/google-auth-library/build/src/auth/oauth2client.js:276:23)
at async GoogleAuth.getAccessToken (/Users/dshenoy/.cache/firebase/tools/lib/node_modules/google-auth-library/build/src/auth/googleauth.js:723:17)
at async autoAuth (/Users/dshenoy/.cache/firebase/tools/lib/node_modules/firebase-tools/lib/requireAuth.js:26:19)
at async Object.requireAuth [as fn] (/Users/dshenoy/.cache/firebase/tools/lib/node_modules/firebase-tools/lib/requireAuth.js:81:20)

Error: Failed to authenticate, have you run firebase login?

[cabljac]

Hi @deepthi3shenoy

Thanks for reporting this issue! We’ve received it and are reviewing it. We’ll provide updates as soon as possible.

[CorieW]

Hey @deepthi3shenoy,

Can you try with export GOOGLE_APPLICATION_CREDENTIALS="..."?

[deepthi3shenoy]

Yes I have tried with double quotes too. On echo $GOOGLE_APPLICATION_CREDENTIALS it prints the json file path

[CorieW]

Just to confirm, you have tried it with export? set won't work, whereas export should (and did for me when reproducing).

[deepthi3shenoy]

Yes it was with export. The below was in my zshrc file
export GOOGLE_APPLICATION_CREDENTIALS="absolute path to json file"

[deepthi3shenoy]

Currently I am using token to make it work but I know it is going to be deprecated. Would appreciate fast resolution.

[deepthi3shenoy]

I am using latest version 13.30.0

[cabljac]

Hi @deepthi3shenoy, we're struggling to reproduce this at the moment, as you can see below:

Are you using any kind of proxy or firewall? does gcloud config get-value proxy/type give you something?

if firebase CLI doesn't have proxy set up:

The CLI supports HTTP(S) proxies via environment variables. To use a proxy, set the HTTPS_PROXY
or HTTP_PROXY value in your environment to the URL of your proxy (e.g.
HTTP_PROXY=http://127.0.0.1:12345/).

but gcloud is configured correctly for a firewall or proxy (see here), it might explain why GOOGLE_APPLICATION_CREDENTIALS doesn't work, but the gcloud approach works.

Also does firebase login work (as a workaround)?

[deepthi3shenoy]

firebase login works
ran gcloud config get-value proxy/type > got (unset)
I disconnected from vpn and also tried

[cabljac]

The original error message you posted is from running the command with --debug right?

[deepthi3shenoy]

yes

[cabljac]

hmm if the service account path is definitely correct, and the json is valid, i'm not sure what the issue can be. I'm still unable to reproduce this so far.

[cabljac]

You're definitely doing source <path-to-your-zshrc> or equivalent after adding the export line right?

[deepthi3shenoy]

The service account path is correct and json is valid because via gcloud it worked . I havent configured any gcloud procy.
I am running source ~/.zshrc
on running echo $GOOGLE_APPLICATION_CREDENTIALS I get the json file path. Hence this configuration is also correct.

[deepthi3shenoy]

For the service account I have given only firebas admin app distribution permission. Are there any others needed

[cabljac]

Thanks for your patience, we will continue to try and reproduce - there must be something different in our environments currently, as we've been unable to repro so far

[cabljac]

@deepthi3shenoy what version of Node are you using?

[cabljac]

Also you mentioned granting it the app distribution role. Does the issue persist when you omit this step?

[deepthi3shenoy]

I am running from my terminal. I took GOOGLE_APPLICATION_CREDENTIALS from a service account. I also tried via firebase admin sdk, This is a needed step to get the creds AFAIK. Is there any other way to get it?

[cabljac]

firebase-tools runs in node, can you do node --version in your terminal?

[cabljac]

I also tried via firebase admin sdk

firebase admin is not picking up the credentials either?

[deepthi3shenoy]

node --version
v20.11.0

I tried to get key from both the below places and it did not work
https://console.cloud.google.com/iam-admin/serviceaccounts : for firebase-adminsdk created new json key

[deepthi3shenoy]

I tried in a new machine and it worked there.
In the machine where it worked on running node --version , I did not get any version. In my other machine where it was not working I got v20.11.0

[cabljac]

Ah interesting. How did you install firebase-tools on the new machine, and how did you install it on the machine where it doesn't work?

I presume on the machine where it worked, you used the standalone binary, via curl -sL firebase.tools | bash ?

[cabljac]

oh this is interesting actually, when using the standalone binary with (presumably) its own bundled node runtime, it works.

On the machine where it doesn't work can you do:

npm ls -g firebase-tools

to check if it was installed via npm?

if it was, you could then try to uninstall, clear npm cache, then reinstall:

npm uninstall -g firebase-tools

npm cache clean --force

npm install -g firebase-tools@13.30.0

[deepthi3shenoy]

[deepthi3shenoy]

It is not installed via npm. I used same below command on both the machines
curl -sL firebase.tools | bash

[cabljac]

Does this happen on version 13.31.0? curl -sL firebase.tools | bash installs this version by default now.

[deepthi3shenoy]

Yes I upgraded and tried in that version also

[deepthi3shenoy]

Hi , any update on this?

[CorieW]

Hi @deepthi3shenoy

We're not too sure, none of us have been able to reproduce this issue on our machines.

What's the macOS versions of the machine you had the issue on, and the machine you didn't have the issue on?