Troubleshooting: Firebase auth/admin-restricted-operation Error

Step-by-Step Solution

Step 1: Enable Sign-in Method in Firebase Console

If the exception triggers during signInAnonymously() or createUserWithEmailAndPassword():

1. 1

   Step 1

   Navigate to the Firebase Console.
2. 2

   Step 2

   Open your project and go to Build > Authentication > Sign-in method.
3. 3

   Step 3

   Locate the target provider (e.g., Anonymous or Email/Password).
4. 4

   Step 4

   Toggle Enable to active and click Save.

Step 2: Delegate Privileged Operations to Firebase Admin SDK

Frontend applications cannot mutate user claims or perform administrative deletes:

// ❌ INCORRECT: Calling admin methods directly from browser JavaScript
// ✔️ CORRECT: Execute inside secure Node.js Cloud Functions with Admin SDK:
import admin from 'firebase-admin';

if (!admin.apps.length) {
  admin.initializeApp({
    credential: admin.credential.applicationDefault()
  });
}

// Safely assign administrative role claims
export async function assignAdminRole(uid) {
  await admin.auth().setCustomUserClaims(uid, { admin: true });
  console.log(`Admin role successfully granted to ${uid}`);
}

Step 3: Verify Google Cloud Identity Platform Settings

If your project operates under GCP Organization Policies:

1. Open Google Cloud Console > Identity Platform > Settings.
2. Under the Security tab, verify that user registration is not blocked by organizational guardrails.

Step 4: Verify API Key API Restrictions

Confirm that your public client apiKey allows access to the Identity Toolkit API:

// firebaseConfig.js
const firebaseConfig = {
  apiKey: "AIzaSy...",
  authDomain: "your-project.firebaseapp.com",
  projectId: "your-project"
};

❓ Frequently Asked Questions (FAQ)

Why does anonymous sign-in throw admin-restricted-operation?

Anonymous authentication is disabled by default in new Firebase projects to prevent automated bot quota exhaustion.

Can I restrict account creation exclusively to administrators?

Yes. You can disable public client self-signup in the Authentication settings and provision users programmatically via the Admin SDK.