Is it safe that my Firebase API key is public?
The Firebase web apiKey is meant to be in your frontend. What actually protects your data: Security Rules, App Check, and key restrictions.
Update (Oct 2026): Google keys can now authenticate to Gemini if the Generative Language API is enabled on the project. Restrict every key so it excludes that API. Read the update →
Yes, the apiKey in your Firebase web config is designed to be shipped to the browser. It identifies your project; it does not grant access by itself. What decides who can read and write is your Firebase Security Rules. That's the same idea as the Supabase anon key.
What actually matters
- Security Rules for Firestore, Realtime Database and Storage.
allow read, write: if true;or expired test-mode rules mean anyone can use your database. See rules open to the public. - App Check to make it harder for scripts outside your app to call your backend.
- API key restrictions in Google Cloud Console (HTTP referrers, and only the APIs you use) to limit abuse of other Google APIs billed to the project.
- Admin SDK service-account JSON is the real secret. It bypasses rules and must never be in frontend code or a public repo.
Quick check
Firebase Console → Firestore/Storage → Rules: look for if true or a request.time < timestamp.date(...) test-mode rule. Then use the Rules Playground to simulate an unauthenticated read of another user's document. It should be denied.
Review my Firebase Security Rules for Firestore, Realtime Database and Storage. Replace any open or test-mode rules with rules that require auth and scope access to request.auth.uid ownership. Confirm no service-account credentials are in client code, and list the API key restrictions I should set in Google Cloud Console.
Related: Firebase rules open to the public · Hide API keys
Scan your app free
Paste your URL. ShipLatch checks for leaked keys, exposed /.env and /.git, and flags Supabase/Firebase so you know what to lock down. The free scan finds the issues; the $29 Fix Pack gives you fix prompts written for your app and re-scans that prove each fix worked.
Want the whole pre-launch process in one place? Get App Security for Vibe Coders, our $9 PDF playbook.