How to solve 'Failed to parse private key: Error: Invalid PEM formatted message.'

[jmyager]

Hi there,

Thanks for creating this great plugin!

I have been attempting to setup my firebase configuration and have had quite some trouble. I've followed the example (initAuth.js & .env.local) as best as possible, however I run into an error upon authenticating through firebase.

I see this error client side: uncaught (in promise) Error: Received 500 response from login API endpoint: {"error":"Unexpected error."}

And server side I've logged out the error: error in login.js: FirebaseAppError: Failed to parse private key: Error: Invalid PEM formatted message.

I've also read through the issue thread that seems to be related but can't figure out exactly what I've done wrong. Any help would be greatly appreciated!

Thank you!

[kmjennison]

Hi, thanks!

Following the example app, can you confirm you're double-quoting the env var (MY_KEY="'----example'") and using JSON.parse during init?

In your local environment, you might also try hardcoding the private key in the config. Of course, do not add that to source control.

[SidneyDaniel]

You've saved me a lot of time, thank you.

[gixi404]

Me funcionó. En Vercel coloqué la variable de entorno entre comillas simples y en el código así:

// @ts-ignore
privateKey: process.env.FIREBASE_PRIVATE_KEY
? process.env.FIREBASE_PRIVATE_KEY.replace(/\n/gm, "\n")
: undefined,

[jocarrd]

Found the issue: I added the private key without any quote and used :

privateKey: process.env.FIREBASE_PRIVATE_KEY
          ? process.env.FIREBASE_PRIVATE_KEY.replace(/\\n/gm, "\n")
          : undefined,

You're a lifesaver, dude . Thanks

thank you !

[nagusubra]

Found the issue: I added the private key without any quote and used :

privateKey: process.env.FIREBASE_PRIVATE_KEY
          ? process.env.FIREBASE_PRIVATE_KEY.replace(/\\n/gm, "\n")
          : undefined,

Thank you, litterally solved the anoying bug for me! GOAT.

[jh97uk]

Thank you again, to say this saved me would be a dire understatement... Especially at 2am!!! 😆

[hagmic]

I struggled with this for a while, none of the proposed solutions were working for me. I ended up Base64 encoding the private key, and then decoding it when initializing next-firebase-auth.

privateKey: process.env.FIREBASE_PRIVATE_KEY 
                 ? Buffer.from(process.env.FIREBASE_PRIVATE_KEY).toString()
                 : undefined

[heytulsiprasad]

For some reason @Murad-Git's code seemed to work for me and not this. What does this do different though? 🤔

[Gcarter17]

just went through this for about an hour, found what I was doing wrong.

1. Make sure your config looks as it was setup for you
   privateKey: process.env.FIREBASE_PRIVATE_KEY ? JSON.parse(process.env.FIREBASE_PRIVATE_KEY) : undefined,
2. make sure your .env.local file has the FIREBASE_PRIVATE_KEY exactly as downloaded off of firebase, with \n's and the BEGIN PRIVATE KEY and everything. I was clearing those thinking that they aren't technically part of the key, but I left it completely as is and get no error...

[ryan-hong]

For anyone still having troubles, i had replied to a previous comment but it might not be seen.
@minuitagency solution is what worked for me

Found the issue: I added the private key without any quote and used :

privateKey: process.env.FIREBASE_PRIVATE_KEY
? process.env.FIREBASE_PRIVATE_KEY.replace(/\n/gm, "\n")
: undefined,

[reilly3000]

This worked for me, thanks very much for highlighting it.

[Wenish]

i needed this. pretty similar but diffrent replace:
privateKey: process.env.FIREBASE_PRIVATE_KEY ? process.env.FIREBASE_PRIVATE_KEY.replace(/\\n/g, '\n') : undefined

i store the key like this in the .env:
FIREBASE_PRIVATE_KEY=-----BEGIN PRIVATE KEY-----\nXXXXXXXXX\n-----END PRIVATE KEY-----\n

[tofuwu-dev]

@Wenish Thanks for your sharing. it works perfectly

[andrerpena]

Thank you very much. This is what worked for me for Digital Ocean, and what I believe would also work for Render and Heroku process.env.FIREBASE_PRIVATE_KEY.replace(/\n/gm, "\n")

[theindustriousdev]

I have also been working on this for an hour! Providing some more detail here in case it helps others. My main problem was not restarting my local server after updating the .env.local file.

This is working for me:

.env.local - the key is double quoted
FIREBASE_PRIVATE_KEY='"-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"'

initAuth.js

...
    firebaseAdminInitConfig: {
      credential: {
        projectId: process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID,
        clientEmail: process.env.FIREBASE_CLIENT_EMAIL,
        privateKey: process.env.FIREBASE_PRIVATE_KEY
          ? JSON.parse(process.env.FIREBASE_PRIVATE_KEY)
          : undefined
      },
      databaseURL: process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL,
    },
...

This library looks like a great solution overall!

[vpaflah]

This worked for me. Please remove the single quotes while deploying into VERCEL the rest is same as mentioned above

FIREBASE_PRIVATE_KEY is "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"

initAuth.js

...
    firebaseAdminInitConfig: {
      credential: {
        projectId: process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID,
        clientEmail: process.env.FIREBASE_CLIENT_EMAIL,
        privateKey: process.env.FIREBASE_PRIVATE_KEY
          ? JSON.parse(process.env.FIREBASE_PRIVATE_KEY)
          : undefined
      },
      databaseURL: process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL,
    },
...

[Michael-Reich]

This still does not work for me on a live enviroment. I use Heroku with these config vars.

And I still get this errors. I tried JSON.parse and .replace() both did not work.

[andrewli-ca]

Just throwing this out there for anyone deploying to Render.com...

Single quote and parse it with JSON.parse. That is what worked for me.

And if you are working locally, the private key value in the .env file must be in double quotes.

[doug-sheridan]

I am using Heroku and @andrewli-ca steps were the only things that worked for me. Note that there is a typo in his message, I think he meant to say, you have to use DOUBLE quotes for both live and local environments. Cheers!

[kaiomoreira-dev]

Thanks, this worked for me. I'm using Render and the problem was it's not converting with JSON.parse(process.env.FIREBASE_PRIVATE_KEY) 🚀

I used double quotes and it worked for me

[AbdelrahmanAbounida]

thanks alot 👍

[aryan04-t]

I was deploying my backend on render and from past 1 hour I was trying to fix this issue, and this solution worked for me, thanks alot :)

[millerm]

I ran into this issue and am deploying my application on Kubernetes via GKE. Posting my solution in case anyone else struggles in the future..

I saved the private key in a .pem file as a Secret and read it in as an env variable in my deployment:

...
env:
     ...
      - name: FIREBASE_PRIVATE_KEY
        valueFrom:
          secretKeyRef:
            name: secret-certs
            key: firebase-private-key.pem
...

No changes needed in my firebaseAdminInitConfig - I didn't need to do any JSON.parse():

    firebaseAdminInitConfig: {
      credential: {
        projectId: process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID,
        clientEmail: process.env.NEXT_PUBLIC_FIREBASE_CLIENT_EMAIL,
        privateKey: process.env.FIREBASE_PRIVATE_KEY
      },

Note that I do set initial values in my Dockerfile to avoid any undefined issues...

ENV NODE_ENV production
ENV FIREBASE_PRIVATE_KEY=setLater
ENV FIREBASE_API_KEY=setLater
ENV COOKIE_SECRET_CURRENT=setLater
ENV COOKIE_SECRET_PREVIOUS=setLater

To debug quickly on K8s, I recommend accessing the pod via kubectl exec -it <pod-name> /bin/sh (I am using node:16-alpine in my Dockerfile). Then, you can simply open up the Node repl and inspect process.env and play around with JSON.parse() or anything.

[ajhenry]

For anyone else running into this error. After trying to replace the \n with the solutions above, I got the following error

{
      "type": "Error",
      "message": "error:0909006C:PEM routines:get_name:no start line",
      "stack":
          Error: error:0909006C:PEM routines:get_name:no start line
              at Sign.sign (node:internal/crypto/sig:131:29)
              at ServiceAccountSigner.sign (/Users/ajhenry/projects/project/node_modules/firebase-admin/lib/utils/crypto-signer.js:65:37)
              at /Users/ajhenry/projects/project/node_modules/firebase-admin/lib/auth/token-generator.js:136:44
              at runMicrotasks (<anonymous>)
              at processTicksAndRejections (node:internal/process/task_queues:96:5)
      "library": "PEM routines",
      "function": "get_name",
      "reason": "no start line",
      "code": "ERR_OSSL_PEM_NO_START_LINE"
    }

I was able to make it work by simply getting rid of the last \n character in my private key and I didn't need to replace any \n at all

FIREBASE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\nXXXXXXX\n-----END PRIVATE KEY-----\n"
                                                                  delete this ---->  ^^

[PolValesBloome]

Hi!

for what I understood, you only deleted the last \n and you do the JSON parse, don't you?

[ajhenry]

Hey there, I deleted the last \n and didn't need to perform a JSON parse

[jonpardev]

Anyone who uses Koyeb, I tried this and it worked perfectly. Just remove the last \n. No '.replace()', 'JSON.parse()' or putting quarter marks to the key value were needed.

[swalker326]

I had a problem that when I stringify my private key it was turning /n in //n. In my .env I changed all of the //n back to /n

so the env entry looks like:

GOOGLE_APPLICATION_CREDENTIALS: '{"type": "service_account"... "private_key":"-----BEGIN PRIVATE KEY-----\netc....'

A few things to note, the entire key needs wrapped in single ' not the normal double " and the \n must remain a \n not a \n in the private key.

then when I use the key:

const serviceAccountKey = JSON.parse(process.env.GOOGLE_APPLICATION_CREDENTIALS as string)
credential: admin.credential.cert(serviceAccountKey),

[osmium8]

For heroku config vars

1. set config var as private_key: -----BEGIN PRIVATE KEY-----\n<STRING>\n-----END PRIVATE KEY-----
2. .js file private_key: (`${process.env.private_key}`).replace(/\\n/g, '\n'),

[shehan-mark]

Anyone faced this issue after resolving the parsing issue?

Error: 16 UNAUTHENTICATED: Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential

My config var looks like this

and I'm trying to read it like this

process.env.FIREBASE_PRIVATEKEY? JSON.parse(process.env.FIREBASE_PRIVATEKEY): undefined;

Im using heroku stack 22. Everything works well in localhost

[shehan-mark]

I came up with a different solution for my case. I converted my entire service account json object to a base64 string and added that to heroku. Then from there I retrieved it and decoded to get the values that I want. Hopefully this will help someone.

[agawrylak]

How do you guys pass either String or undefined there? for me it complains that privateKey can only be string

TS2322: Type 'string | undefined' is not assignable to type 'string'.   Type 'undefined' is not assignable to type 'string'. index.d.ts(81, 7): The expected type comes from property 'privateKey' which is declared here on type '{ projectId: string; clientEmail: string; privateKey: string; }'

[jonpardev]

You can add codes raise an error when it is undefined, or just simply use thatString = thisString || "" . The || "" part will return empty string when it is undefined. But in this case, you might not be able to figure out where the error comes from, when thisString is undefined with any reason.

[FoodlyEric]

What worked for me is on vercel environment variable.
Remove all \n and quotes from your private key string and replace it with actual newline. (you can do this in vscode and copypaste)
No need to JSON.parse

[joshgervais]

Mine keeps giving me this error when deploying to vercel:

FirebaseAppError: Failed to parse private key: Error: Invalid PEM formatted message.
at new ServiceAccount (/var/task/node_modules/firebase-admin/lib/app/credential-internal.js:153:19)
at new ServiceAccountCredential (/var/task/node_modules/firebase-admin/lib/app/credential-internal.js:70:15)
at Object.cert (/var/task/node_modules/firebase-admin/lib/app/credential-factory.js:103:54)
at Object. (/var/task/config/firebaseConfig.js:12:34)
at Module._compile (node:internal/modules/cjs/loader:1376:14)
at Module._extensions..js (node:internal/modules/cjs/loader:1435:10)
at Module.load (node:internal/modules/cjs/loader:1207:32)
at Module._load (node:internal/modules/cjs/loader:1023:12)
at exports.b (/var/task/___vc/__launcher/chunk-5UAC7W5H.js:1:1142)
at /var/task/___vc/__launcher/bridge-server-BGIDXK2J.js:1:1443 {
errorInfo: {
code: 'app/invalid-credential',
message: 'Failed to parse private key: Error: Invalid PEM formatted message.'
},
codePrefix: 'app'
}
INIT_REPORT Init Duration: 306.15 ms Phase: init Status: error Error Type: Runtime.ExitError
FirebaseAppError: Failed to parse private key: Error: Invalid PEM formatted message.
at new ServiceAccount (/var/task/node_modules/firebase-admin/lib/app/credential-internal.js:153:19)
at new ServiceAccountCredential (/var/task/node_modules/firebase-admin/lib/app/credential-internal.js:70:15)
at Object.cert (/var/task/node_modules/firebase-admin/lib/app/credential-factory.js:103:54)
at Object. (/var/task/config/firebaseConfig.js:12:34)
at Module._compile (node:internal/modules/cjs/loader:1376:14)
at Module._extensions..js (node:internal/modules/cjs/loader:1435:10)
at Module.load (node:internal/modules/cjs/loader:1207:32)
at Module._load (node:internal/modules/cjs/loader:1023:12)
at exports.b (/var/task/___vc/__launcher/chunk-5UAC7W5H.js:1:1142)
at /var/task/___vc/__launcher/bridge-server-BGIDXK2J.js:1:1443 {
errorInfo: {
code: 'app/invalid-credential',
message: 'Failed to parse private key: Error: Invalid PEM formatted message.'
},
codePrefix: 'app'
}
INIT_REPORT Init Duration: 525.09 ms Phase: invoke Status: error Error Type: Runtime.ExitError
Error: Runtime exited with error: exit status 1

Here is my firebaseConfig.js:

require("dotenv").config();

const serviceAccount = {
  projectId: process.env.FIREBASE_PROJECT_ID,
  privateKey: process.env.FIREBASE_PRIVATE_KEY.replace(/\\n/g, '\n'),
  clientEmail: process.env.FIREBASE_CLIENT_EMAIL,
};

if (!admin.apps.length) {
  admin.initializeApp({
    credential: admin.credential.cert(serviceAccount),
  });
}

const db = admin.firestore();

module.exports = { db, admin };

In my Vercel environment variables, I removed all of the \n and quotes from my private key string and replaced it with actual newlines.

Here is my example:

-----BEGIN PRIVATE KEY-----
LONGLONGLISTOFKEYS
LONGLONGLISTOFKEYS
LONGLONGLISTOFKEYS
-----END PRIVATE KEY-----

Any possible recommendations to help out a lad with a silly problem?

[naveenbasyal]

hey have you find any solution?

[thelovesmith]

Did you ever find a solution for this for Vercel? I tried a couple of the options above, and I am still getting the error.

[Luiyit]

In Amazon Beanstalk I needed to add single quote to the environment (double quote is not accepted)

[anirudhuuu]

thanks a lot for sharing this tip! was stuck in it forever

[samugdho]

Testing for a React app deployed on Vercel, I've had the same parsing problem with the
.env.local as

FIREBASE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\nMIIE...XtQ\n-----END PRIVATE KEY-----\n"

And this is my fix

const env = process.env;
// FIX: Add auto-removed parts
let PrivateKey = "-----BEGIN PRIVATE KEY-----\n" + (env.FIREBASE_PRIVATE_KEY || "").replace(/\\n/g, "\n") + "\n-----END PRIVATE KEY-----\n";
try {
  admin.initializeApp({
    credential: admin.credential.cert({
      projectId: env.FIREBASE_PROJECT_ID,
      privateKey: PrivateKey,
      clientEmail: env.FIREBASE_CLIENT_EMAIL,
    }),
  });
  
} catch (error) {
  console.error("Error initializing Firebase:", error);
}

[bahadirtasgin]

As of April 25, 2025, when adding your Firebase private key manually to Vercel, the simplest and most reliable solution is:
• Just remove the double quotes from the key,
• And make sure your code uses .replace(/\\n/g, '\n')

More complex solutions still work, but this is the cleanest and most up-to-date method.