Firebase Admin：verifyIdToken正常但getUser调用失败求助

我的Firebase Admin初始化配置如下：

firebaseAdmin.initializeApp({
  credential: applicationDefault(),
  projectId: "${my_project_id}",
});

其中verifyIdToken功能可以正常运行：

firebaseAdmin
    .app()
    .auth()
    .verifyIdToken(idToken)
    .then((decodedIDToken) => {
      console.log("decodedIDToken: ", decodedIDToken);
    })
    .catch((error) => {
      console.log("error: ", error);
    })

但调用getUser方法时抛出权限错误：

firebaseAdmin
      .app()
      .auth()
      .getUser(uuid)
      .then((data) => {
        console.log("user: ", data);
      })
      .catch((error) => {
        console.log("error: ", error);
      });

错误信息如下：

errorInfo: {
    code: 'auth/internal-error',
    message: '//cloud.google.com/docs/authentication/adc-troubleshooting/user-creds . Raw server response: "{"error":{"code":403,"message":"Your application is authenticating by using local Application Default Credentials. The identitytoolkit.googleapis.com API requires a quota project, which is not set by default. To learn how to set your quota project, see https://cloud.google.com/docs/authentication/adc-troubleshooting/user-creds .","errors":[{"message":"Your application is authenticating by using local Application Default Credentials. The identitytoolkit.googleapis.com API requires a quota project, which is not set by default. To learn how to set your quota project, see https://cloud.google.com/docs/authentication/adc-troubleshooting/user-creds .","domain":"usageLimits","reason":"accessNotConfigured","extendedHelp":"https://console.developers.google.com"}],"status":"PERMISSION_DENIED","details":[{"@type":"type.googleapis.com/google.rpc.ErrorInfo","reason":"SERVICE_DISABLED","domain":"googleapis.com","metadata":{"service":"identitytoolkit.googleapis.com","consumer":"projects/${some_project_ID"}}]}}"'
  },
  codePrefix: 'auth'
}

我已经做了以下操作：

• 执行命令设置应用默认配额项目和默认项目：

$ gcloud auth application-default set-quota-project ${some_different project}
$ gcloud config set project ${my_project_id}

• 确认两个项目均已启用Identity Toolkit API：
  

解决方案 #

1. 统一配额项目与Firebase项目
   错误提示明确指出Identity Toolkit API需要关联配额项目，你当前设置的配额项目与Firebase项目ID不一致，这会导致权限校验失败。执行以下命令将配额项目设置为你的Firebase项目ID：

   gcloud auth application-default set-quota-project ${my_project_id}
   

2. 刷新应用默认凭证
   重新登录以确保配额项目的设置生效：

   gcloud auth application-default login
   

3. 检查IAM角色权限
   确保应用默认凭证使用的账号在你的Firebase项目（${my_project_id}）中拥有Firebase Auth Admin角色，或者至少包含identitytoolkit.users.get这个具体权限。

4. 改用服务账号密钥初始化（备选方案）
   如果应用默认凭证的问题无法解决，可以直接使用Firebase项目的服务账号密钥进行初始化，绕过ADC的配额问题：

   const serviceAccount = require('./path/to/serviceAccountKey.json');
   
   firebaseAdmin.initializeApp({
     credential: firebaseAdmin.credential.cert(serviceAccount),
     projectId: "${my_project_id}"
   });
   

内容的提问来源于stack exchange，提问作者Fallen