title: How to Use Firebase-Admin SDK with Credentials of ServiceAccount in Different Project?
body: <p>I have two Google Cloud Platform projects - let's call them <code>proj-a</code> and <code>proj-b</code>. I have a GCP ServiceAccount created in <code>proj-a</code> that tries to access user objects that are managed by Firebase Authentication running on top of <code>proj-b</code>.</p>
  
  <p>The ServiceAccount has been assigned the <code>Firebase Authentication Admin</code> Google Cloud IAM role on the firebase project.</p>
  
  <p>The output of the following code snippet looks promising:</p>
  
  <pre><code>import firebase_admin
  from firebase_admin import auth
  
  app = firebase_admin.initialize_app(options={"projectId": "proj-b"})
  print(f"app: {app.project_id}")
  print(f"creds: {app.credential.project_id}")
  </code></pre>
  
  <pre><code>app: proj-b
  creds: proj-a
  </code></pre>
  
  <p>But when I now call <code>auth.get_user("some-id")</code> I get the error message: <code>Identity Toolkit API has not been used in project {PROJECT_NUM_OF_PROD_A} before or it is disabled.</code> Of course, the identity toolkit has not been enabled on <code>proj-a</code> since Firebase is running on <code>proj-b</code>. How to get this running? The ServiceAccount is located in <code>proj-a</code> because most other components of the backend are located there. Defining the ServiceAccount in <code>proj-b</code> is therefore not an acceptable solution for me.</p>
  
  <p>Full (cleaned) stack trace below:</p>
  
  <pre><code>Traceback (most recent call last):
    File "/usr/local/lib/python3.7/site-packages/firebase_admin/_user_mgt.py", line 397, in get_user
      response = self._client.request('post', 'getAccountInfo', json=payload)
    File "/usr/local/lib/python3.7/site-packages/firebase_admin/auth.py", line 514, in request
      resp.raise_for_status()
    File "/usr/local/lib/python3.7/site-packages/requests/models.py", line 940, in raise_for_status
      raise HTTPError(http_error_msg, response=self)
  requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://www.googleapis.com/identitytoolkit/v3/relyingparty/getAccountInfo
  
  During handling of the above exception, another exception occurred:
  
  Traceback (most recent call last):
    File "/usr/local/lib/python3.7/site-packages/firebase_admin/auth.py", line 230, in get_user
      response = user_manager.get_user(uid=uid)
    File "/usr/local/lib/python3.7/site-packages/firebase_admin/_user_mgt.py", line 400, in get_user
      self._handle_http_error(INTERNAL_ERROR, msg, error)
    File "/usr/local/lib/python3.7/site-packages/firebase_admin/_user_mgt.py", line 545, in _handle_http_error
      raise ApiCallError(code, msg, error)
  firebase_admin._user_mgt.ApiCallError: Failed to get user by user ID: some-id.
  Server response: {
    "error": {
      "code": 403,
      "message": "Identity Toolkit API has not been used in project {PROJECT_NUM_OF_PROD_A} before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project={PROJECT_NUM_OF_PROD_A} then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
      "errors": [
        {
          "message": "Identity Toolkit API has not been used in project {PROJECT_NUM_OF_PROD_A} before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project={PROJECT_NUM_OF_PROD_A} then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
          "domain": "usageLimits",
          "reason": "accessNotConfigured",
          "extendedHelp": "https://console.developers.google.com"
        }
      ],
      "status": "PERMISSION_DENIED"
    }
  }
  
  
  During handling of the above exception, another exception occurred:
  
  Traceback (most recent call last):
    File "&lt;stdin&gt;", line 1, in &lt;module&gt;
    File "/usr/local/lib/python3.7/site-packages/firebase_admin/auth.py", line 233, in get_user
      raise AuthError(error.code, str(error), error.detail)
  firebase_admin.auth.AuthError: Failed to get user by user ID: some-id.
  Server response: {
    "error": {
      "code": 403,
      "message": "Identity Toolkit API has not been used in project {PROJECT_NUM_OF_PROD_A} before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project=543111740960 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
      "errors": [
        {
          "message": "Identity Toolkit API has not been used in project {PROJECT_NUM_OF_PROD_A} before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project=543111740960 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
          "domain": "usageLimits",
          "reason": "accessNotConfigured",
          "extendedHelp": "https://console.developers.google.com"
        }
      ],
      "status": "PERMISSION_DENIED"
    }
  }
  </code></pre>
  
  <hr>
  
  <h2>Update after updating firebase-admin client library</h2>
  
  <p>As mentioned by @Hiranya Jayathilaka I was not running the latest version of the firebase admin SDK. After updating from version <strong>2.14.0</strong> to <strong>3.2.1</strong> the app appears to connect to the correct project but I still get a permission denied error. I checked the permissions of the used ServiceAccount on proj_b and even gave it roles/firebase.admin as well as roles/editor just to make sure I do not lack any necessary permissions.</p>
  
  <pre><code>Traceback (most recent call last):
    File "/usr/local/lib/python3.7/site-packages/firebase_admin/_user_mgt.py", line 479, in get_user
      'post', '/accounts:lookup', json=payload)
    File "/usr/local/lib/python3.7/site-packages/firebase_admin/_http_client.py", line 113, in body_and_response
      resp = self.request(method, url, **kwargs)
    File "/usr/local/lib/python3.7/site-packages/firebase_admin/_http_client.py", line 105, in request
      resp.raise_for_status()
    File "/usr/local/lib/python3.7/site-packages/requests/models.py", line 940, in raise_for_status
      raise HTTPError(http_error_msg, response=self)
  requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://identitytoolkit.googleapis.com/v1/projects/{PROJECT_ID_OF_PROD_B}/accounts:lookup
  
  During handling of the above exception, another exception occurred:
  
  Traceback (most recent call last):
    File "&lt;stdin&gt;", line 1, in &lt;module&gt;
    File "/usr/local/lib/python3.7/site-packages/firebase_admin/auth.py", line 268, in get_user
      response = user_manager.get_user(uid=uid)
    File "/usr/local/lib/python3.7/site-packages/firebase_admin/_user_mgt.py", line 481, in get_user
      raise _auth_utils.handle_auth_backend_error(error)
  firebase_admin.exceptions.PermissionDeniedError: Error while calling Auth service (Identity Toolkit API has not been used in project {PROJECT_NUM_OF_PROD_A} before or it is disabled. Enable it by visiting https). //console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project={PROJECT_NUM_OF_PROD_A} then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.
  </code></pre>