Is my Firebase API key a secret? (And when a Google key is a real leak)
Every Firebase web app ships an apiKey in its config object, so anyone can see it in DevTools. Firebase's docs say that's fine: the key only identifies your project. What actually protects your data is Security Rules and App Check. The catch is that a Google API key is only harmless if it's restricted to Firebase services.
Scan your live app free Passive, no signup, never touches your database.
1. The short answer
Per Firebase's docs, API keys restricted to Firebase services don't need to be treated as secrets, and it's safe to include them in your code or config files. None of the Firebase-related APIs use the key as authorization; it only identifies your project for routing, quota and billing.
2. What actually protects your data
Firestore, Realtime Database and Cloud Storage are protected by Firebase Security Rules, and covered APIs by App Check, not by hiding the key. If your rules allow public reads or writes, anyone with your (public) config can use them. Run through our Firebase Security Rules checklist.
3. Check the key's API restrictions
Google Cloud console → APIs & Services → Credentials. Your Firebase key is usually named "Browser key (auto created by Firebase)". Its API restrictions should list only Firebase-related APIs. If it says "Don't restrict key", it can call any API enabled in your project. Firebase restricted its auto-created keys in May 2024, but keys you created yourself were not changed.
4. Make sure Gemini isn't on that key
Firebase's docs are explicit: never include the Gemini Developer API (Generative Language API) in the allowlist of a publicly accessible key. A key named "Gemini API Key" or "Gemini Developer API key (auto created by Firebase)" must never appear in your code or config files. If one is in your front-end bundle, treat it as leaked: delete or rotate it and call Gemini from a server or Cloud Function instead.
5. Use separate keys for other Google APIs
Maps, Places and other Google Cloud APIs should each get their own key, restricted to that API (and by HTTP referrer for browser use). That way you can rotate them without breaking Firebase.
6. Tighten Auth quota if you use password sign-in
With your public key, someone can hit Firebase Authentication endpoints. Firebase suggests tightening the identitytoolkit.googleapis.com quota to match your normal traffic to blunt brute-force attempts.
7. Scan your live app
Unspill finds Google API keys in your page and JavaScript bundles. If it also sees a Firebase config, it marks the key as informational and reminds you to check its restrictions; a Google key with no Firebase config around it is flagged as low, with a reminder to restrict it by referrer and API or keep it server-side.
Fix guides for these issues
- Google API key in client code: AIza keys in front-end code are fine for Firebase but dangerous for Gemini or paid Maps APIs. Restrict them by HTTP referrer and API in Google Cloud Console.
- Verify Firebase Security Rules: Your Firebase web config is public by design, so Firestore, Realtime Database and Storage rules are the only protection for user data. Here's how to check them.
FAQ
Google emailed me about a publicly accessible API key. Is my Firebase app hacked?
Not necessarily. Firebase's docs say to check that the key is used only for Firebase services, has the needed Firebase APIs in its API restrictions, and has no other APIs (especially Generative Language API) on the list. If so, it's safe to be public.
Should I hide my Firebase config in environment variables?
You can, and it helps you use separate keys per environment, but it doesn't make the key secret: it still ends up in the browser. Security comes from rules and App Check.
Is a firebase-admin service account key the same thing?
No. Service-account JSON (with a private_key) grants admin access that bypasses Security Rules. It must never be in client code; if it leaked, delete it in Google Cloud IAM and create a new one.
Sources
Last checked against these sources on 2026-10-19. Platforms change; when in doubt, the official docs win.