Firebase Hosting deploy fails: 403 "Permission denied to get service [firebasehosting.googleapis.com]"

Request to https://serviceusage.googleapis.com/v1/projects/<project>/services/firebasehosting.googleapis.com had HTTP Error: 403, Permission denied to get service [firebasehosting.googleapis.com]

Short answer: firebase-tools 15.34.1 (22 October 2026) checks that the Hosting API is enabled before every Hosting deploy. A service account without the serviceusage.services.get permission now fails with this 403. Give it the Service Usage Consumer role, or pin firebase-tools to 15.34.0. 15.34.2 doesn't change it.

Why it happens

15.34.1 added a call to ensure() for the Hosting API in firebase deploy and in every hosting: command (channel:deploy, channel:create, sites:list and others). That call asks the Service Usage API whether firebasehosting.googleapis.com is enabled. The check() function in src/ensureApiEnabled.ts doesn't catch the error, so a 403 stops the command before anything deploys. The deploy service account that firebase init hosting:github creates has Hosting rights but no Service Usage role, so CI deploys that worked on 15.34.0 fail on 15.34.1. GitHub Actions pick up the new version without asking, because FirebaseExtended/action-hosting-deploy runs npx firebase-tools@latest. We checked the code change in the firebase-tools source on 31 October 2026. The issue is open with three reports, and pinning 15.34.0 got a deploy through for one of them.

You may also see

reason: AUTH_PERMISSION_DENIED, permission: serviceusage.services.get

Fix

Check it's this: run npx firebase-tools --version (or look at the CI log). 15.34.1 or newer plus the 403 above means it's the new API check.
Lasting fix: give the deploy service account the Service Usage Consumer role (roles/serviceusage.serviceUsageConsumer). It includes serviceusage.services.get, and also .use, which the request needs because the CLI bills the call to your project. With gcloud: gcloud projects add-iam-policy-binding PROJECT_ID --member=serviceAccount:SA_EMAIL --role=roles/serviceusage.serviceUsageConsumer. Or use Console → IAM → the service account → Grant access. Wait a few minutes for IAM to apply, then re-run.
Quick fix when you can't change IAM: pin the CLI to the last version without the check. Locally run npx firebase-tools@15.34.0 deploy --only hosting; in package.json use "firebase-tools": "15.34.0".
In GitHub Actions with action-hosting-deploy (always the latest CLI), replace that step with a plain run step until it's fixed, for example npx firebase-tools@15.34.0 hosting:channel:deploy pr-${{ github.event.number }} --expires 7d --project PROJECT_ID with GOOGLE_APPLICATION_CREDENTIALS pointing at the same service-account key.
Re-run the deploy. With the role in place, the log shows required API firebasehosting.googleapis.com is enabled before the upload.

Build still red, or no time to dig in? I fix it for you: send a GitHub invite or a zip, and you get a tested pull request that makes the build pass on the new version. No passwords or production keys needed.

Get it fixed: $49

Pay by card, no account needed. Pull request within 48 hours; build still failing, full refund.

Watch out

One user reports that the Consumer role alone didn't help. Make sure it's granted on the same project the deploy targets, and to the account CI actually uses. If it still fails, pin 15.34.0.
Don't grant Owner or Editor just for this. Consumer, or Viewer plus Consumer, is enough for the check.
If you pin, remove the pin once a firebase-tools release handles the 403 (watch issue #11335), so you get security fixes such as the body-parser CVE fix in 15.34.2.

Sources

Did this fix it?

Other errors breaking soon

All "breaking soon" fixes