Troubleshooting Firestore access

Firewatch talks to Firestore directly from your browser, using your own Google account's permissions: the same ones the Firebase console uses. Your Firestore Security Rules don't apply (they govern your app's end users, not project members), so there's no need to loosen them.

“Permission denied”

Your Google account doesn't have a Firestore role on this project.

Ask a project owner to grant one of these roles in Google Cloud IAM:

Cloud Datastore Viewer (roles/datastore.viewer): browse and export.
Cloud Datastore User (roles/datastore.user): also create, edit, delete, and import.

Project Owners and Editors already have access. Listing projects also needs at least Firebase Viewer.

“API not enabled”

The Cloud Firestore API is turned off for the project.

Enable Cloud Firestore API in the Google Cloud console under APIs & Services, then try again. If the project has no Firestore database yet, create one in the Firebase console first.

“Index required”

Filtering on one field while sorting by another needs a composite index.

Firewatch shows a Create index button with a link Firestore generates. Open it, confirm in the Firebase console, and wait for the index to finish building (usually a few minutes). Single-field filters and sorts work without extra indexes.

“Google access expired”

Google access tokens last about an hour.

Click Reconnect. You won't be asked to approve anything again unless you revoked access in your Google account settings.

Still stuck?

If you can see the data in the Firebase console but not in Firewatch, make sure you picked the same Google account in both. Back to your projects.