Firebase Remote Config Fetch failed with user not authorized

Question

I'm trying to set up my production application to use remote config, but I'm getting a FirebaseRemoteConfigFetchException. This project is already deployed, we use FCM, Crashlytics and Dynamic Links. If I use the dev project on firebase everything work just fine. So I don't think it's the google-service.json configuration. The only difference between the configurations is in the production instance I have the SHA certificate fingerprint setup.

2019-02-08 22:59:52.755 19724-19744/? W/System.err: java.io.IOException: com.google.android.gms.internal.firebase_remote_config.zzas.read() returned value out of range -1..255: -117 2019-02-08 22:59:52.755 19724-19744/? W/System.err: at java.util.zip.GZIPInputStream.readUByte(GZIPInputStream.java:273) 2019-02-08 22:59:52.755 19724-19744/? W/System.err: at java.util.zip.GZIPInputStream.readUShort(GZIPInputStream.java:260) 2019-02-08 22:59:52.755 19724-19744/? W/System.err: at java.util.zip.GZIPInputStream.readHeader(GZIPInputStream.java:165) 2019-02-08 22:59:52.755 19724-19744/? W/System.err: at java.util.zip.GZIPInputStream.(GZIPInputStream.java:80) 2019-02-08 22:59:52.755 19724-19744/? W/System.err: at java.util.zip.GZIPInputStream.(GZIPInputStream.java:92) 2019-02-08 22:59:52.756 19724-19744/? W/System.err: at com.google.android.gms.internal.firebase_remote_config.zzad.getContent(Unknown Source:46) 2019-02-08 22:59:52.756 19724-19744/? W/System.err: at com.google.android.gms.internal.firebase_remote_config.zzd.zza(Unknown Source:12) 2019-02-08 22:59:52.756 19724-19744/? W/System.err: at com.google.android.gms.internal.firebase_remote_config.zzm.zza(Unknown Source:14) 2019-02-08 22:59:52.756 19724-19744/? W/System.err: at com.google.android.gms.internal.firebase_remote_config.zzg.zzb(Unknown Source:5) 2019-02-08 22:59:52.756 19724-19744/? W/System.err: at com.google.android.gms.internal.firebase_remote_config.zzaa.zzad(Unknown Source:178) 2019-02-08 22:59:52.756 19724-19744/? W/System.err: at com.google.android.gms.internal.firebase_remote_config.zzf.zzi(Unknown Source:51) 2019-02-08 22:59:52.757 19724-19744/? W/System.err: at com.google.android.gms.internal.firebase_remote_config.zzer.zzc(Unknown Source:41) 2019-02-08 22:59:52.757 19724-19744/? W/System.err: at com.google.android.gms.internal.firebase_remote_config.zzer.zzb(Unknown Source:23) 2019-02-08 22:59:52.757 19724-19744/? W/System.err: at com.google.android.gms.internal.firebase_remote_config.zzer.zza(Unknown Source:149) 2019-02-08 22:59:52.757 19724-19744/? W/System.err: at com.google.android.gms.internal.firebase_remote_config.zzes.then(Unknown Source:6) 2019-02-08 22:59:52.757 19724-19744/? W/System.err: at com.google.android.gms.tasks.zzf.run(Unknown Source:2) 2019-02-08 22:59:52.757 19724-19744/? W/System.err: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1162) 2019-02-08 22:59:52.757 19724-19744/? W/System.err: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:636) 2019-02-08 22:59:52.757 19724-19744/? W/System.err: at java.lang.Thread.run(Thread.java:764) 2019-02-08 22:59:52.757 19724-19744/? E/FirebaseRemoteConfig: Fetch failed! Server responded with an error. com.google.android.gms.internal.firebase_remote_config.zzd: 403 Forbidden at com.google.android.gms.internal.firebase_remote_config.zzm.zza(Unknown Source:14) at com.google.android.gms.internal.firebase_remote_config.zzg.zzb(Unknown Source:5) at com.google.android.gms.internal.firebase_remote_config.zzaa.zzad(Unknown Source:178) at com.google.android.gms.internal.firebase_remote_config.zzf.zzi(Unknown Source:51) at com.google.android.gms.internal.firebase_remote_config.zzer.zzc(Unknown Source:41) at com.google.android.gms.internal.firebase_remote_config.zzer.zzb(Unknown Source:23) at com.google.android.gms.internal.firebase_remote_config.zzer.zza(Unknown Source:149) at com.google.android.gms.internal.firebase_remote_config.zzes.then(Unknown Source:6) at com.google.android.gms.tasks.zzf.run(Unknown Source:2) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1162) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:636) at java.lang.Thread.run(Thread.java:764) 2019-02-08 22:59:52.759 19724-19754/? E/FirebaseRemoteConfig: Fetch failed! com.google.firebase.remoteconfig.FirebaseRemoteConfigFetchException: Fetch failed: The user is not authorized to access the project. Please make sure you are using the API key that corresponds to your Firebase project. Check logs for details. at com.google.android.gms.internal.firebase_remote_config.zzer.zzc(Unknown Source:77) at com.google.android.gms.internal.firebase_remote_config.zzer.zzb(Unknown Source:23) at com.google.android.gms.internal.firebase_remote_config.zzer.zza(Unknown Source:149) at com.google.android.gms.internal.firebase_remote_config.zzes.then(Unknown Source:6) at com.google.android.gms.tasks.zzf.run(Unknown Source:2) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1162) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:636) at java.lang.Thread.run(Thread.java:764)

Answer 1

For testing purposes, to isolate a Remote Config issue, I had created a second app in the same Firebase project. I ran into this same issue. (I'm using flutter, but this would likely apply to Android, iOS...)

When I created the second app, it also created a second (unrestricted) API key. However, the newly-downloaded google-services.json lists both keys for my second (testing) app.

      "api_key": [
        {
          "current_key": "<this is the key for the original app>"
        },
        {
          "current_key": "this is the key auto created for the Testing app"
        }
      ],

There doesn't seem to be a way, at least in the console, to specify which API key should be used for each app. (UPDATE - See #4 in resolution below) So google-services.json appears to be project-wide and contains every client, with every API key. The first key was used, which is for the non-testing app, and was more locked down. Thus causing this issue.

Resolution

Remove the api_key from that is incorrect for the app from google-services.json, since it will select the first one. Or see #4 below

How to diagnose this issue

1. Print out the Firebase options to get active api_key

void main() async {
  WidgetsFlutterBinding.ensureInitialized();
  await Firebase.initializeApp(
    // options: DefaultFirebaseOptions.currentPlatform, <- Uncomment this if using generated firebase_options.dart
  );
  print(Firebase.apps[0].options.toString() + "\n");

result: I/flutter (22314): {apiKey: some-api-key, appId: 1:some-app-id ...

2. Search workspace to see where key is provided, probably in google-services.json

3. If you know this is incorrect and want to force other key, remove incorrect key and clean, rebuild. To Fix correctly, see next step.

4. Per this doc the google-services.json associates the app with the key via the bundle Id, which isn't set by default. Find the key in Cloud console (not Firebase console) in API -> Credentials. Set the restrictions on the key to Android (for example) with bundleId and sha.

Link contents for prosperity!

"How does Firebase know which API key to match to an app (like in the Firebase config file/object)?

When you first obtain your app's Firebase config file/object, Firebase checks if there are any existing API keys in your project that have "Application Restrictions" that match the app (for example, a matching bundle ID for the Apple app).

If Firebase doesn't find any restricted keys that match, then it will list in the config file/object the iOS key for Apple apps, the Android key for Android apps, and the Browser key for web apps (assuming that these keys exist and have no "Application Restrictions" that keep them from matching to that app)."

Answer 2

I faced a similar issue in my Flutter project (it includes Android and iOS). On Android everything works fine (don't forget to add your debug SHA-1 in firebase settings) but on iOS I got the following error messages:

Runner[630:137105] 6.22.0 - [Firebase/RemoteConfig][I-RCN000026] RCN Fetch failure. Response http error code: 403

Runner[630:137105] 6.22.0 - [Firebase/Performance][I-PRF710001] Unable to fetch configurations.

Accepted answer by @eslimaf is correct but if Remote Config is already enabled you should try the comment by @cosic, it saved my day.

For those who struggle to find where to change those restrictions I'll add a few screenshots. All credits to @cosic

1. Go to https://console.developers.google.com

2. Open Credentials tab, open Android or iOS key in API Keys section

3. Check "Don't restrict key" or if you check "Restrict key" - make sure you've added all your services that you need.

4. Click SAVE, changes will take effect in a couple of minutes.

Hope this helps!

Answer 3

After digging a little bit, and looking all over the place, I found that for some reason I had to go to https://console.developers.google.com -> Enable API and Services -> Firebase Remote Config, and enable that API. After doing that everything started to work again.

I hope this helps someone in the future, cheers!