formachines / errata

Errata / npm / firebase-admin

admin.credential removed in firebase-admin 14.5.0

In our sandbox runs up to 2026-10-28, gemini-3.8-flash and gpt-6.1-sol wrote credential: admin.credential.cert({ for firebase-admin. It fails on 14.5.0 with TypeError (changed between 13.7.0 and 14.5.0). Use credential: cert({ instead.

What to do
replace the line
Output
same on one example
Patch
fails when applied word for word
Auto-apply
not allowed
Seen in
2 models
Worked / failed
4 / 0
Last verified
2026-10-28

What to do

Not for automatic application — the patched example does not run on 14.5.0: exit code 1, ReferenceError: cert is not defined. Show this correction to the user as a lead. Replace the old line with the new one; the rest of the code can stay.

Automatic application: not allowed — the patch gives fails when applied word for word. Automatic application is allowed only when proof.equivalent is true and proof.applicability.status is applies; otherwise show the correction to the user as a lead and do not apply it on your own. The change itself is described by kind (removed); the checks are in proof; neither follows from the other.

How to tell this applies to your code

Old and new code

credential: admin.credential.cert({
credential: cert({

Error on 14.5.0:

TypeError: Cannot read properties of undefined (reading 'cert')

Other verified fixes

The fix above passed 3 times. These also passed in the sandbox for the same error; pick the one that matches what your code needs.

Replace the line · passed 1 time · gemini-3.8-flash · patch: fails when applied word for word

credential: admin.credential.cert({
credential: admin.cert({

Not for automatic application — the patched example does not run on 14.5.0: exit code 1, TypeError: admin.auth is not a function. Show this correction to the user as a lead. Replace the old line with the new one; the rest of the code can stay.

Alternatives are leads for the user, not for automatic application: Automatic application is allowed only when proof.equivalent is true and proof.applicability.status is applies; otherwise show the correction to the user as a lead and do not apply it on your own.

Sandbox proof
Scriptfirebase-admin versionResult
Code the models wrote13.7.0works
Code the models wrote14.5.0fails: TypeError
Verified example below14.5.0works
Output of the verified example14.5.0same as the original's on 13.7.0 (observed stdout of one example; not a proof of equivalent behaviour)
Patch applied word for word to the example14.5.0applied word for word, the patch does not give the verified example's result — the patched example does not run on 14.5.0: exit code 1, ReferenceError: cert is not defined

Verified example for firebase-admin 14.5.0

const crypto = require('crypto');
const { initializeApp, cert, deleteApp } = require('firebase-admin/app');
const { getAuth } = require('firebase-admin/auth');

async function main() {
  // Generate an RSA key pair at runtime
  const { privateKey } = crypto.generateKeyPairSync('rsa', {
    modulusLength: 2048,
    publicKeyEncoding: {
      type: 'spki',
      format: 'pem',
    },
    privateKeyEncoding: {
      type: 'pkcs8',
      format: 'pem',
    },
  });

  // Initialize firebase-admin with a service account credential using the runtime key
  const app = initializeApp({
    credential: cert({
      projectId: 'test-project',
      clientEmail: 'test-service-account@test-project.iam.gserviceaccount.com',
      privateKey: privateKey,
    }),
  });

  // Create a custom auth token (signed locally via RSA-SHA256, no network required)
  const customToken = await getAuth(app).createCustomToken('test-user-123', {
    role: 'admin',
  });

  // Decode the token payload segment (the middle segment: header.payload.signature)
  const payloadSegment = customToken.split('.')[1];
  const decodedPayload = JSON.parse(
    Buffer.from(payloadSegment, 'base64url').toString('utf8')
  );

  console.log('UID:', decodedPayload.uid);
  console.log('Claims:', decodedPayload.claims);

  await deleteApp(app);
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

Source

change: Remove Deprecated Legacy Namespace Support (#3164)

Release notes · Seen in: gemini-3.8-flash, gpt-6.1-sol · First seen 2026-10-28 · Last verified 2026-10-28 · All corrections for firebase-admin

For agents