FirebaseAuthError in firebase function while generating custom auth token using createCustomToken

Question

I am trying to move my custom authentication code from a firebase-queue worker to a firebase function. I am getting following error when I try to call the createCustomToken method.

Below is the code that I am using to create the custom token

const admin = require('firebase-admin');
admin.initializeApp(functions.config().firebase);
admin.auth().createCustomToken(uid, additionalClaims ? additionalClaims : {})

Below it the error on the Firebase Functions dashboard

Error: createCustomToken() requires a certificate with "private_key" set.
    at FirebaseAuthError.Error (native)
    at FirebaseAuthError.FirebaseError [as constructor] (/user_code/node_modules/firebase-admin/lib/utils/error.js:25:28)
    at new FirebaseAuthError (/user_code/node_modules/firebase-admin/lib/utils/error.js:90:23)
    at FirebaseTokenGenerator.createCustomToken (/user_code/node_modules/firebase-admin/lib/auth/token-generator.js:62:19)
    at Auth.createCustomToken (/user_code/node_modules/firebase-admin/lib/auth/auth.js:89:37)
    at Object.generate (/user_code/helpers/AuthTokenGenerator.js:7:37)
    at ref.child.child.once.then (/user_code/index.js:59:35)
    at process._tickDomainCallback (internal/process/next_tick.js:129:7)

Similar function works currently in the firebase-queue worker implementation but there I initialize the app using the service account as suggested on the docs. I am guessing the problem is with the initializeApp call but this is how it is suggested on the Firebase Functions doc.

Answer 1

Your application default credentials are not sufficient to mint custom tokens, you'll need pass a service account certificate to initializeApp.

You can see this in action in our LinkedIn auth example on Github.