Firebase FAQ

The page is a collection of FAQs and troubleshooting help for Firebase in general, as well as for specific products.

Do you have other challenges or can't find your issue described on this page?



Platforms and frameworks

Visit the platform-specific troubleshooting & FAQ pages for helpful tips and answers for more FAQ.



Firebase projects and Firebase apps

Permissions and access to Firebase projects

API keys for Firebase

Here are the most important things to learn about API keys for Firebase services:
  • Public by design: API keys for Firebase services only identify your Firebase project and app to those services. Authorization is handled through Google Cloud IAM permissions, Firebase Security Rules, and Firebase App Check.
  • Apply restrictions: All Firebase-provisioned API keys are automatically restricted to Firebase-related APIs. For all API keys in your project, it's critical that you apply appropriate API restrictions to prevent unauthorized use of your project's quota for APIs.
  • Use only for Firebase services: Use your Firebase-provisioned API keys only for Firebase-related APIs. If your app uses any other APIs (for example, the Places API for Maps or the Gemini Developer API), use a separate API key and restrict it to the applicable API. In particular, never include the Gemini Developer API in the allowlist for a publicly accessible API key or a key used for other services.
  • Security Rules and App Check are critical: Security of your Realtime Database, Cloud Firestore, and Cloud Storage data is enforced using Firebase Security Rules, and protection of covered APIs is by Firebase App Check — not by keeping your Firebase API key secret.

If your app's setup follows the above guidelines, then API keys restricted to Firebase services do not need to be treated as secrets, and it's safe to include them in your code or configuration files.