Firestore API returns 403 CONSUMER_INVALID despite API enabled, billing active, and Console access working

Google Cloud Database
1

I am troubleshooting a Google Cloud Firestore issue where authenticated API requests consistently return:

HTTP 403 PERMISSION_DENIED
reason: CONSUMER_INVALID
service: firestore.googleapis.com

Project ID: (PII Removed by Staff)
Project number: (PII Removed by Staff)
Region: africa-south1

Verified:

  • Project is ACTIVE.
  • Billing is active and linked to the project.
  • Cloud Firestore API is ENABLED.
  • Service Usage API is ENABLED.
  • Service Usage REST reports firestore.googleapis.com as ENABLED for project (PII Removed by Staff).
  • My Google account is Project Owner.
  • Cloud Run runtime service account:
    (PII Removed by Staff)
    has roles/editor.
  • Firebase/Firestore Console can successfully create and read documents in the (default) database.
  • A test document diagnostic/cloud-test was successfully created in Firestore.
  • Using an OAuth access token for the same Cloud Run service account, Cloud Storage REST works successfully.
  • The same token fails against Firestore REST with 403 CONSUMER_INVALID.
  • Firestore REST fails using both the project ID and project number.
  • Adding x-goog-user-project: (PII Removed by Staff) does not resolve the issue.
  • The Python google-cloud-firestore client running in Cloud Run produces the same CONSUMER_INVALID error.

The Cloud Run container/runtime and Python execution have been independently verified; the failure occurs when the authenticated request reaches Firestore.

Could this indicate a Firestore/Service Control consumer-registration or project-consumer state issue? What diagnostic or remediation would you recommend?

Thanks.

1 Like