Guide
Firestore "Missing or insufficient permissions"
Updated
Your app shows an empty page, a failed save or a console error saying "Missing or insufficient permissions". This applies to apps from AI builders that use Firebase and Cloud Firestore.
Why it happens
Every request to Firestore from a web or mobile app is checked against your security rules first. If the rules deny any document in the request, the whole request fails.
Possible causes
- The rules only allow signed-in users, and the visitor is signed out.
- The rules tie data to the user's ID, and the signed-in user's ID does not match the path the app reads or writes.
- No rule covers the path the app uses.
- One document in a multi-document request is not allowed, so the whole request is denied.
- The rules were changed recently and have not taken effect yet; Firebase says it can take up to a minute for new queries and up to ten minutes for active listeners.
You can't see it yourself
You're signed in, your customers aren't. You test signed in as the owner, who the rules happen to allow. A different user, or a signed-out visitor, is judged by the same rules and may be refused.
Related: Data won't save: "new row violates row-level security policy" · Users can see other users' data in my Lovable app · My builder says the app is tested, but my customers hit problems
VibeFix is independent. Lovable, Bolt, Replit, Base44, v0, Supabase, Firebase, Stripe and Vercel are trademarks of their owners.
Want it fixed?
Our AI agent finds the cause, fixes it in your code and re-checks your live app. $79 for one bug, paid up front. If we can't complete your re-check, you get your money back.
It starts with a free check that confirms the problem on your live app, no account needed.