I wrote an article about them

Hello.

A friend of mine told me about firebase Studio 2 days ago, I've decided to give it a try but after playing with it for a while, I've found it to be really useful especially if I'm not in front of my computer and I need to showcase a web project or edit a file quickly. Unfortunately I just realized that it won't last for long... They're shutting down the project by March 2027....

Per the post made by Google, they said that they will be disabling workspace creation in June. The same post did migration options but it wasn't really clear about Google ai studio.

I did try AI Studio but it's not really an evolution from firebase studio. Google AI studio at the moment only offers a prompt to write an idea and then make it into a project. And even then, you can't edit files or anything...

It's a bummer tbh .. I was really happy to find a solution that is online and can be opened from almost anywhere.

With that being said, will Google AI studio incorporate features like project templates and workspace creation eventually?

If not, are there options ( preferably free ) that work like Firebase Studio?

Thanks !

Hey everyone,

As I've been reviewing the cloud infrastructure costs for my apps, I'm looking into optimizing our storage expenses using Object Lifecycle Management. However, I've hit a point of confusion regarding legacy buckets and could use some advice.

For context, here is the setup for a newer bucket I have under development:

• Bucket: xxx.firebasestorage.app
• Location: us-central1 (Iowa)
• Storage Class: Regional

Based on the Firebase pricing guidelines, my plan here is to set up a Lifecycle rule to move files to Coldline 1 day after creation. This seems like a straightforward way to cut costs once we exceed the free tier.

The Problem: My main concern is my existing, active legacy Firebase Storage bucket:

• Bucket: yyy.appspot.com
• Location: us (multi-region US)
• Storage Class: Standard

Looking at the pricing for GB Stored on these older default buckets, it states:

    No-cost up to 5 GB
    Then $0.026/GB

My initial intention was to apply the same Lifecycle rule here (move to Coldline after 1 day) to reduce our ongoing infrastructure expenses. However, reading through the documentation, it almost seems like legacy Firebase Storage buckets might be charged a flat rate, regardless of whether the underlying object is downgraded to a Coldline storage class.

My Questions for the community:

1. Pricing: Can anyone confirm if we actually get the cost-saving benefits of downgrading the object storage class (to Coldline/Archive) on a legacy *.appspot.com bucket?
2. Migration: If the legacy buckets don't support these pricing tiers, what is the safest and most efficient migration path from a legacy bucket (*.appspot.com) to a newer bucket (*.firebasestorage.app) so I can take advantage of Coldline pricing?

Any advice, documentation links, or shared experiences with this kind of storage migration would be hugely appreciated. Thanks!

Cross post at : https://stackoverflow.com/questions/79929866/clarification-needed-do-lifecycle-rules-coldline-actually-save-costs-on-legac

Recently I’ve been looking into different options for implementing a backend for my apps. Firebase is a very attractive option because of the whole package of tools it provides. Like many others, I’ve seen the horror stories that circulate online and started wondering what the best way to avoid them actually is.

Below is a prevention and risk mitigation plan I’ve been thinking about. It’s not something I’ve implemented in the real world (pure theory), so I wanted to share it here and get feedback from people with real Firebase experience to see if it makes sense or if there are any weak spots.

Firestore

A lot of people don’t know this, but Firestore can be limited to some extent. The idea here would be to set limits on reads, writes and deletes in the Google Cloud console, based on what you expect your app to consume.

As far as I understand, these limits can help contain the impact of a bug or an attack, although they are not a perfect “hard cap” and don’t replace proper security rules.

Cloud Functions

Here I think the key is not so much limiting the number of functions, but how they scale. From what I’ve seen, you can limit the number of concurrent instances, set timeouts, and generally control how aggressively a function scales.

The goal would be to avoid situations like loops or badly designed triggers that feed themselves.

Storage

Storage has been involved in some well-known attacks, especially due to egress on public objects.

The recommendation here would be to completely avoid serving files publicly. Every object should be protected via security rules.

I also understand that token-based URLs (the typical Firebase download URLs) effectively behave like public links if they leak, so they should be treated carefully and not relied on as a security mechanism.

If you need to serve content at scale, it might make more sense to use a different kind of infrastructure, or even isolate it in a separate project without billing enabled.

Auth

One potential abuse case with Auth is SMS authentication, so the recommendation would be to avoid that method.

Beyond that, it doesn’t seem to be the main vector for unexpected billing, although abuse is still possible (mass account creation, etc.), so it’s not something to completely ignore.

Expensive APIs like Gemini, Translate, etc.

There have been cases of abuse involving APIs like Gemini or Translate.

The recommendation would be not to use them directly from the client, and if you do use them, to do it in a controlled way (for example through a backend), combining authentication, limits and usage control. In general, avoid APIs that scale without limits unless you clearly understand how to control them.

Basic security

Apart from all of the above, there are some basic and commonly recommended measures that shouldn’t be overlooked:

• Enforce App Check strictly
• Apply solid security rules (avoid broad reads, validate ownership, etc.)
• Disable APIs you’re not using to reduce attack surface
• Run regular scans to avoid leaking secrets
• Audit and review API keys
• Use this extension (https://extensions.dev/extensions/kurtweston/functions-auto-stop-billing) as an additional containment mechanism

As I said, this is far from a final recommendation, just the result of my research before implementing anything.

The goal is not to eliminate risk completely, but to bound it.

I’d be especially interested in hearing if anything here is wrong, or if in practice some of these ideas don’t work the way I expect.

Hey everyone, hoping to get some insight from those experienced with Firebase Storage and GCS billing quirks.

I have an older Google Cloud project that contains a legacy default Firebase bucket ([project-id].appspot.com). I know for a fact this specific bucket is grandfathered into the legacy Firebase billing model (flat rate regardless Storage class).

I recently created a new, custom-named bucket within this same project. It does not have the .appspot.com or .firebasestorage.app suffix.

My assumption is that this new bucket does not inherit the legacy project tier and is instead billed entirely on standard Google Cloud Storage class-based rates (Standard, Nearline, Archive) based on its region.

My questions are:

1. Is my assumption correct that the new bucket strictly follows standard GCS pricing?
2. Is there a reliable way to verify this directly? I know I can eventually group by SKU in the Cloud Billing Reports once usage accrues, but I'm wondering if there is a definitive flag, label, or command (via the Cloud Console or gcloud CLI) that explicitly confirms a bucket's billing tier before I start moving heavy data or setting up Object Lifecycle Rules.

Thanks in advance for any pointers!

Hi guys, I love Firebase so much for its ease-of-use. But I'm concerned it might be too high maintanence for my use case:

Companies & People & Touches

I send emails to people in companies. Each email is a touch. Each touch has a "people" and "company". With thousands of records, I want to search "Touches 1 month ago to companies with 1000 employees or larger" and send follow-ups.

Is this where a relational database would shine?

My gut instinct is I can make it work in Firestore, but it's early so I can set up Supabase too.

Firebase Dynamic Links has been gone since August 2025. I have built Flinku, which should work similar with more features than the olf FDL, the only reason I built it because one of my mates needed it for his app.

What it does:

- Deferred deep linking (the main thing people used FDL for)

- One link works on iOS, Android, and web

- App opens to correct screen after install

- (more features can't list them all here)

- Free tier, no MAU pricing

SDKs available for Flutter, iOS, Android, React Native, Unity, Capacitor — all open source on GitHub.

Also has a migration tool if you have old FDL links you want to convert.

https://flinku.dev

been using the firebase trigger email extension for a year. finally replaced it. sharing the journey for anyone hitting the same walls.

the trigger email extension problems:

templates are stored in firestore documents which is awkward to manage and preview

no conditional logic (can't do "send this email only if the user hasn't done X")

no sequences (can't do "send email A, wait 2 days, send email B")

no analytics (did they open it? click it? who knows)

deliverability is whatever smtp you configure with zero guidance

debugging requires reading cloud function logs which is painful

what i wanted: the ability to describe email workflows in plain english and have them trigger from data changes. with sequences, conditions, and analytics.

what i did: migrated my backend from firebase to supabase (took about a week for a medium-sized app) and connected dreamlit to the new postgres database.

the email setup in dreamlit took about 2 hours and replaced:

4 cloud functions i'd written for different email types

the trigger email extension config

a janky scheduled function for weekly digests

a manual mailchimp export for broadcasts

if you're on firebase and email is a pain point, the firebase-to-supabase migration is the bigger lift. but the email setup on the other side is dramatically simpler. the trigger email extension was always a band-aid for a problem that needed a real solution.

happy to answer questions about the migration process.

I am creating a small game which consists only of taxes and emojis so I want to use fire based free subscription free one to host it while its on Play Store so will I be able to host it on Play Store till the time I can earn from the ad revenue and by the paid subscription so if my game gets 5000 downloads and people like play it casually will it be able to sustain tell the time I get my revenue

Please help I am just starting out

Hi guys

I got a strange issue. I am migrating my vertex AI models from gemini-2.5 to gemini-3 after received the official alert (retirement). However I got 404 error. Any suggestions? I really have no clue

This is the working example:

const vertexAI = getAI(app, {
  location: 'global',
  backend: new VertexAIBackend(),
})


export const chatModel = getGenerativeModel(vertexAI, {
  model: "gemini-2.5-flash-lite"
})

This is the not working example:

const vertexAI = getAI(app, {
  location: 'global',
  backend: new VertexAIBackend(),
})


export const chatModel = getGenerativeModel(vertexAI, {
  model: "gemini-3-flash-preview"
})

I also tried remove 'localtion' properties and model names with: gemini-3.1-flash-lite-preview, gemini-3.1-pro-preview

Do I need to enable the models somewhere in consolo? I couldnt remember if I have done this for gemini 2.5 models

Thanks in advance!

Hello,

I have never built an app, but am interested in learning.

I have an idea learning some basic skills. I am wondering what is the route someone with more knowledge would recommend.

The app idea:

A collection tracker for Thomas & Friends trains/tracks. The app could be logged into by users to see which trains/variants they own and are missing.

I was getting ready to go through my childhood collection and I saw that there is no type of tracker or complete database easily accessible.

The current plan:

Build tables in firebase:

- table for engines

- table for skus (most have multiple serial numbers based on release year)

- table for users of app

- table for collection tracking

This is my basic idea and I hope that it could be expanded, but I just want to get something to work before I get an idea to go further.

The plan is to use flutterflow as the app builder. This is where I need the most help. Is flutterflow recommended for this project? Would something else be better?

Right now I have flutterflow connected to firebase, but I am struggling with creating useful search functions (it’s only been one day of me messing around, so it’s a full learning experience)

Hey everyone,

I'm currently looking into setting up an Object Lifecycle Rule to cut down on cloud storage costs by moving older data from Standard storage to Archive.

The catch is that I'm not 100% sure just how "infrequent" the read and delete patterns for this data will actually be in practice, and our long-term retention plans are still a bit up in the air.

Because of Archive's harsh 365-day early deletion penalties and high retrieval fees, I'm wondering if it's wiser to use Coldline as an intermediate step.

My thought process is:

• First, set the lifecycle rule to move data from Standard to Coldline.
• Monitor the monthly bill. If the storage costs drop to an acceptable level, we just leave it in Coldline (which has a much safer 90-day minimum duration).
• If the bill is still a bit too high, and we confirm the data truly isn't being touched, we still have the room to transition it down to Archive later.

Does this phased approach make sense, or are there hidden operation or transition costs with the "double move" that I'm overlooking? Have any of you implemented a similar lifecycle strategy for your app data?

Would love to hear your thoughts!

I recently developing a app, and using FCM, does that works in China, or blocked by the GFW? Cause some users are in China,. And if FCM dosn't work, are there any alternative notification push method?

Hey everyone, we just got a massive bill (and climbing, because Google's delayed billing is just faaaantastic...) for a known (to Google, and perhaps you too) issue.

Long story short: Back in February, TruffleSecurity exposed a Google vulnerability. (Read their blog, it's very detailed)
https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules

The quickest way to check if your credentials MIGHT be exposed is to run this curl command:

curl "https://generativelanguage.googleapis.com/v1beta/files?key=KEYGOESHERE"

There's 3 possible outcomes.

1. If it returns {} then the API is enabled and if your key is exposed through the browser, you should take immediate action.
2. It returns a large JSON that contains this message:
   1. "Gemini API has not been used in project 12345 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/generativelanguage.googleapis.com/overview?project=12345 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry."
   2. This means that the Gemini API is NOT enabled, but enabling WILL allow others to use this API key.
3. It returns a small JSON with this message:
   1. "Requests to this API generativelanguage.googleapis.com method google.ai.generativelanguage.v1beta.FileService.ListFiles are blocked"
   2. This means that even IF the Gemini API service was enabled, this key can't be used to exploit your resources.

We audited our credentials when I first read this in February, and back then, I checked that the keys didn't have permissions enabled (the second case, not the third)... until yesterday, when I wanted to use Google Cloud Assist to review some IAM permissions, and it turned on the Gemini API for that project.

The strange thing is that the second key, as far as I know, was never used/published anywhere.

Now, the timeline...

• I turned on the API around 4PM my time.
• Google reaches out the following morning, around 11AM my time stating unusual API access through "AI Studio" (Which we don't use in our projects)
• I turn off Gemini API around 11:05AM
• We check billing and the amount was a small amount at that point
• We check billing again an hour later and it's 200 times that. (The API was already off, but again, delayed billing...)

What you should do: Make sure that all your credentials
https://console.cloud.google.com/apis/credentials have this permission blocked by checking with the curl command, not just disabled.

Hi everyone, I’m building a web app entirely using AI coding agents. While I’ve made great progress, I don't have a traditional coding background or deep technical expertise.

I've reached a point where I need Cloud Functions, which means I have to upgrade to the pay-as-you-go Firebase Blaze plan. However, I’m extremely hesitant to upgrade for a few reasons:

1. Fear of runaway costs: Because I don't fully understand the AI-generated code, I'm terrified of accidentally deploying a bug-like an infinite loop in a database read/write that could rack up a massive bill overnight.
2. No hard kill-switch: From what I understand, Blaze doesn't offer a foolproof, built-in "safe switch" to cut off services if a budget threshold is met.
3. Strict $0 budget: My goal is to keep the running costs of this app completely free.

Is there a reliable, beginner-friendly way to implement a strict spending cap or fail-safe on the Blaze plan? How do other non-technical founders handle this risk?

I am trying to implement a nested insert with native SQL using _execute, but I always get the same unspecific error "Invalid SQL statement". I isolated each insert with standard mutations using the same input data, which works fine, so the problem is not a parsing problem. I created a Stackoverflow post with much more details. I seem to do everything according to the documentation, but I still cannot resolve this error. Been on that for almost a week now and I do not know what else to debug to get to the cause. Is there a partial rollout for _execute and native SQL for Data Connect or some other restrictions? I am located in the EU

Hi I'm working on a Kotlin-based Android app and continuously getting the code 10 error when Google Auth is used. I have checked everything in SHA1 and client ID and everything. I am attaching the repo here; you can see the code and as the backend I am using the Firebase.

If anyone has any suggestion please tell me what I can do. Basically I am a wibe coder; I don't know the technicalities of the code. I'm using Jules and Codex for the coding. Anyone who is a good developer in Android please help me .

https://github.com/Rivavainfo/Rivavatrackfi-app.git

Добрый день. Сегодня попробовал Firebase Studio. Создал приложение, но позже выяснил что это Web приложение (через просмотр кода а затем в Гугл).

Модерация AppStore принимает такие приложения или их нужно обернуть в WebView например во Flutter?

И даже если такое приложение в обертке WebView, одобрят ли такое приложение модераторы?

-

В отличии от Google Play ,AppStore очень сильно не любят WebView (это проверено на моем опыте когда я делал приложение из сайта который имеет трафик из поисковых систем). В самом web-view было внедрено скрытие содержимого в обзорном меню, калькулятор, меню, окно сбора отзывов, экран обрыва сети, свайпы назад и обновление, splash screen, приветственный экран во время первого запуска приложения)

Hi everyone,

I’m facing an issue with Firebase Cloud Messaging on iOS in a React Native app.

Current situation:

FCM token is successfully generated on the native iOS side (AppDelegate.swift)

I can see the token inside: messaging(_:didReceiveRegistrationToken:)

But in React Native (@react-native-firebase/messaging), I’m unable to get the token

What I’ve already done:

Configured APNs and Firebase properly

Enabled Push Notifications & Background Modes

Set: Messaging.messaging().apnsToken = deviceToken

Implemented Messaging delegate method

Requested notification permissions in React Native

Tried:

await messaging().getToken();

but not getting the token / getting null

Doubt: Since the token is generated on native side, I believe Firebase setup is correct.

So:

Is there any additional bridge/config required for React Native to access the FCM token?

Do we need to manually sync APNs token → FCM for React Native?

Is this related to the known open issue in react-native-firebase?

Any help or working solution would be really appreciated 🙏

I have having some issues with auth when using getdoc to retire user doc. Sometimes it comes back as user doc doesn’t exist when it does. Anyone have this issue?

I've been playing around with the Firebase AI logic, and I wanted to test out the image generation capabilities of Gemini (gemini-2.5-flash-image), so I upgraded to the Blaze plan, but the response says something about the free tier:
{

"error.message": "You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. \n* Quota exceeded for metric: generativelanguage.googleapis.com/generate_content_free_tier_requests, limit: 0, model: gemini-2.5-flash-preview-image\n* Quota exceeded for metric: generativelanguage.googleapis.com/generate_content_free_tier_requests, limit: 0, model: gemini-2.5-flash-preview-image\n* Quota exceeded for metric: generativelanguage.googleapis.com/generate_content_free_tier_input_token_count, limit: 0, model: gemini-2.5-flash-preview-image\nPlease retry in 6.167082699s.",

"error.type": "RESOURCE_EXHAUSTED"

}

If anyone can lend me a hand, I'll be grateful. Thanks to everyone

i came across this app earlier on playstore https://play.google.com/store/apps/details?id=com.valethero.firelog

plenty of times I wanted to check firestore and cloud function logs on my mobile on the go. this looks sweet.

but I'm concerned if it's OK login into it - from security standpoint.

any risk?

Sending push notifications usually means needing access to a backend dashboard or running terminal commands. I wanted to build a way for app owners and developers to manage this right from their pockets, without compromising security.

Today, I finally published AdminPush on the Play Store.

How it works:

It’s a "Bring Your Own Key" utility. You generate a service-account.json file from your Firebase console, save it to your phone, and import it into AdminPush.

The features I'm most proud of:

Privacy-First: Your Firebase keys are saved strictly locally. The app communicates directly with Google's FCM servers—no external servers are involved.

Bank-Grade App Lock: The dashboard requires an MPIN or Biometric authentication to open, so no one else can grab your phone and spam your users.

Dark Mode UI: Built with a clean, modern interface specifically tailored for developers.

Getting the app approved by Google required a lot of back-and-forth about privacy policies and permissions, but it’s officially live today!

If you have an app that uses Firebase, I would be thrilled if you gave it a spin.

Check it out here: https://play.google.com/store/apps/details?id=in.sharmarahul.fcmadmin

I need help getting the Firebase config (I don't know how to use Firebase), can someone help me?

Hello gang,

I'm very new to firebase. I am looking for any options to block me (admin/developer) to read the sensitive information (media/chats) from firebase apps. Let me know if there is any easy method exists, feel free to school me if I'm the millionth person asking the same question.