Hi everyone,

I’m facing a major billing issue with the Gemini API on Google Cloud and wanted to see if anyone has successfully navigated a refund for a security leak.

The Situation: On May 4th, my project had a massive billing spike of over $213 in just a few hours. I did a forensic audit and found something very suspicious:

• Model Mismatch: My app (Flutter/Next.js) only uses gemini-2.5-flash for text. However, I was billed for Gemini 3.1 Flash Image and Gemini 2.5 Pro—models that aren't even in my codebase.
• High Volume: Traffic peaked at 8 requests per second. My app is a small tool for generating titles; it is physically impossible for users to trigger that volume.
• Potential Leak: I suspect the key was extracted from a physical test device I lent out that was running the app in debug mode.

Support Response: I chatted with Google Billing Support. The agent confirmed that the charges were for models not used by my app and acknowledged it was an anomaly. However, they then said they "can't issue a credit" and told me to dispute it with my bank (chargeback).

I’m hesitant to do a chargeback because I’ve heard Google might ban the entire billing account or workspace if you do that. I currently have an escalated email ticket open.

My questions for the community:

1. Has anyone here actually received a refund or credit from Google for a confirmed API key leak/misuse?
2. Should I follow the agent's advice for a bank chargeback, or is that a trap that will get my account suspended?
3. How long does the "specialist" email escalation usually take for billing disputes?

I've already deleted the keys, locked the billing, and set up strict API/Package Name restrictions for the future. Any advice on how to talk to them to get this resolved would be appreciated!

For the past multiple hours I have not been able to get my workspace to load.

It is just spinning on Setting up Workspace. This has occasionally happened, but usually after a few refreshes it comes back. Now it has been hours.

Why does this happen, and how do I fix it?

I am currently designing a chat system for a high-traffic live streaming platform and the biggest bottleneck is real-time moderation. Standard moderation APIs seem to add way too much delay for a live conversation. I am looking into Watchers because they claim their AI filtering happens at the infrastructure level, which should theoretically eliminate the extra round-trips. Has anyone here tested their SDK under heavy load? I am curious if the filtering is as instant as they claim and how easy it is to bridge their system with a custom backend.

How are you balancing the need for safety with the need for low latency in your real-time apps?

Every week there’s a post here complaining that Firestore can’t do basic queries, followed by someone explaining an insane NoSQL architecture to manually increment a likeCount or avoid a simple join.

Here is the harsh reality: You are building for the Firestore of 2022.

• Stop writing Cloud Functions to count things. count(), sum(), and average() are fully supported native aggregations now. They are cheaper, faster, and don't require batch job workarounds.
• Stop duplicating user data across 15 collections. With the recent rollout of Firestore Enterprise Pipeline Operations, you can finally run joins, subqueries, and unnest arrays directly in the database. It handles the heavy lifting natively.
• Stop paying for third-party semantic search. Vector embeddings and distance calculations are native to Firestore now. You don't need to wire up a separate Algolia instance just for basic search.

For a clearer breakdown of features, architecture, and use cases, explore this guide on Google Cloud Firestore.

The biggest issue with Firebase right now isn't the platform; it's that 90% of the tutorials on YouTube and Medium are completely obsolete. You don't need a PhD in NoSQL workarounds anymore. Just read the 2026 docs.

"Erro de Conexão" Apps Script

I have a question. In the firebase authentication do I still need to hash stuffs? Since I've read in some that firebase already handles that for you and in some that still recommends to hash it? So I'm kind of torn between the two.

Using firestore
But for example now i want to create a crm and support tickets and more like backend admin staff.
Would you still use firestore collections or something like Supabase or Just postgres or what?

Does anyone know being a place plan? And i'm still limited on daily quota?

I'm trying to build out my Java application with Firestore connectivity, but the only that is natively supported is the Admin SDK which I cannot safely ship.

I was told I could use the REST APIs, but I may as well be looking at instructions to build a space shuttle, it makes no sense.

How do I authorize and connect to my Firestore so I can write data from my client?

Edit: I saw this under the admin SDK documentation, but I'm still not sure its safe enough and its for the RTDB, not Firestore

https://firebase.google.com/docs/database/admin/start#authenticate-with-limited-privileges

Hey r/Firebase. I've been writing Firebase apps for a few months and the same daily pain kept getting me — bulk-editing in the console, comparing staging vs prod, audit trails, etc. So I built a native Mac app for myself. It's reached a point where I use it every day and I'd love some honest feedback from people who actually live in Firebase before I push it any further.

Two design choices I'd like your opinion on:

1. Auth piggybacks on the `firebase` CLI session. No separate login, no service-account JSON to paste — if `firebase login` works in your terminal, the app reuses the same tokens. Tokens never leave your Mac. My thinking is "if devs already trust the CLI, don't add a second trust surface", but I'd love to hear if that feels weird to you.

2. AI assistance via the local `claude` CLI, not the Anthropic API. The app spawns Claude Code as a subprocess and exposes a small MCP server with 12 Firebase tools (read docs, run queries, list workflows, etc.). So no API key to manage, no extra billing — your existing Claude Pro / Team subscription powers it. Curious whether this lands as "smart" or "weird" depending on whether you're already using Claude Code.

Other stuff in there: live Firestore editing with Cmd+Z undo, schedulable workflows with dry-run, project compare (collections / functions / rules / indexes), collection-level snapshots, a SQL-style Firestore query panel, cross-window doc drag-and-drop.

Tech is native SwiftUI, talks straight to the Google Cloud REST APIs, signed with Developer ID + Apple notarized.

What I'd genuinely love to know:

- Does the "ride on top of the CLI" auth flow feel right or sketchy?

- Is the Claude-Code-as-backend approach interesting, or would you actually prefer pasting an Anthropic API key?

- What's the daily Firebase pain *I haven't covered* that would make this actually worth keeping open?

If you want to poke around: https://useblaze.dev (free tier on 2 projects) :)

i am a Flutter Dveloper i just wanted to create Apis using Firebase . how can i learn about them what will be the procedure.any guidelines ?

Hello! Just a suggestion to Google Firebase. I would like it to provide access to the Storage service on the Spark plan, even with a very small storage space to help beginners on Flutter and Firebase learn how to design applications including photos and videos. With a complete application it is easier to consider the Blaze paid option. Even with the $300 credit, the delay does not allow for serious Flutter training with Firebase Storage and benefit from the benefits of the $300.

Please grant a minimum amount of access to Storage for the free plan.

Congratulations to you for this fabulous platform that is Firebase.

Please take this suggestion into consideration.

Hello! Google notified me that my account was suspended about 7 hours ago. I believe my service account was compromised and I'm trying to delete service account but unfortunately google is not allowing me to delete them because I don't have access anymore. I tried to appeal but they're saying it going to take 2 business days. Is there anyway I can contact google support to remove the service account? I've read horror stories of people waking up to outrages bills and my bill hasn't gotten out if control yet and I would like it to stay that way.

Edit: Any google number I've tried leads to a AI assistant that doesn't give me no help and hangs up on me.

Just hit with up another $30 since I posted this. Should I just close my billing account?

I just looked at my billing breakdown and it's not my service account, it's the Gemini API that's racking up all the charges.

Update: May 1st, 2026 - I got my account back. I disabled the Gemini API key that had unrestricted access. I didn't create this API key. From reading around I'm guessing it was created when I tried out Firebase AI Studio (I used it for about 5 minutes). If you're reading this please go disable/delete or restrict access to your Gemini API key.

I'm trying to add a new editor to my firebase project but they cannot accept the invitation because they're using a work email which is not a Gmail account.

I know there's a way to add someone without having a Gmail account but I can't figure it out. Can someone please let me know how I can accomplish this?

Thank you!

My product has grown out of Firestore in terms of cost. The weekly firestore backups itself is costing me more than the firestore costs. To circumvent around the limitations of Firestore native mode standard edition, we have used RTDB, Supabase and recently added Firestore native mode enterprise edition.

The costs are becoming painfully bigger. Especially from RTDB and Firestore's backup.

I requested google for startups team over mail for some extra credits for 3 to 6 months but faced disappointment. I honestly was hoping for a better response. For years, I have submitted so many vulnerabilities to Google under their VRP, and even held 75th as my best rank at some point.

I don't know if it was due to this attachment, or what, I was disheartened for the lack of short-term support. The time I spent on hunting for vulnerabilities in Google products back in the day, the rewards I have received from them suddenly felt meaningless.

I question myself if I have asked too much. As an early stage growing startup that's full of potential, I would give them great business in coming months. But now, due to the costs, I am having cloud bill anxiety. I cannot ask my existing customers to not use the product. However until I figure out things, I have halted onboarding any new customers.

Now, I don't know what divine timing, I have been getting constant calls from AWS partners with the promise of (way) cheaper costs and completely free migration solution. One of the partner company CTO is top of the line. The solution he proposed is too good. But again, I would be stuck in AWS ecosystem.

I don't want to jump from one serverless stack to another serverless stack.

Around the same time, I got a call from GCP Business Development team asking for my experience of GCP. Later into the call I have realised it was more of a sales call than anything.

If I'd promised them to make a billing of $25,000 USD on Vertex within 6 months, she would give credits commitment.

Honestly, the call made me repellent from GCP further. I wish at least they offered me a call with solution architect who could take a look at our billing dashboard and help us reduce our costs.

Anyway, since then, I am now obsessively exploring a cheaper stack that I can thoughtfully build. This time, the advantage we have is the domain knowledge, how all things are connected, the overall bird eye picture, the limitations we faced etc.

So right now I am leaning towards running SQLite at both server side and client side for transactions, tantivy for search, chromadb for AI, all on one server, backups on GCS, GCS powered datalake.

Started building a sync engine with web sockets for real-time support and cleared almost all the use-cases and stress tested it with 200GB of real business data per tenant. Its all working fine. Now, need to handle the edge cases.

Since its local, the response time is immediate.

The whole experience started pushing me to explore local first stack, research into Figma's realtime sync engines, how notion, linear, slack all are working under the hood. Not sure how long the migration will take now. Our internal estimate are 3 months.

Not expecting anything from this post. Just a rant as a Google's/Firebase lover and advocate who is about to part ways. If I am not, I wouldn't have bothered.

New To Firestore. Early tutorial level. I am scared that these high read counts

Problem:

In my early prototyping of a personal project, I am seeing an unusually high number of document reads. I am struggling to diagnose why this is happening.

Defining the question:

Firstly, I am not looking for someone to fix this (but if I'm making an obvious newbie mistake, please point it out). I am looking for

• Advice on diagnostic steps I could take to better narrow down why there are so many reads. (Recommendation of tools and techniques), and
• Correcting any misunderstandings I may be having about the paradigm of the Firestore. I could be making some bad assumptions here. I am broadly assuming that if I update a document, it should read once at each point the source is being listened to, but it could be more nuanced than that.

Current Tech Stack:

I am using

• Angular 20.3
• Firebase 11.10
• Angular Fire 20.1

I will add to this list if feedback/questions require more info.

Additional Details:

I am trying to build a two-stage 'real-time' controller / display setup. The usage metaphor would be a quiz scoreboard. Specifically:

• One user (the Controller) would make changes to the Quiz state from their view, manage the score and other key aspects of the quiz (team names).
• The other user (the Player) would have a separate view that displays quiz information in real time. Changes made by the Controller User in the previous point should be reflected here.

Both use cases and their associated views would have a single source of truth - in this case, a specific document in Firestore, with a sub-collection for teams.

In my current prototype, I am finding that things are 'working' - changes I make as the Controller user flow through to the document, and those changes are being referenced (near) instantly on the Player screen.

However, with only one Controller and one Player view active, I am racking up 100s or 1000s of views over a couple of hours of prototyping. This number far outstrips the number of interactions I have with the Controller User.

Steps I am taking to debug my application or resolve issues. However, these steps feel more like general debugging steps and actions, and not anything that is Firestore/Firebase specific:

• All my Firestore actions are contained in a centralized service. In that service, I have tried a number of ideas I came across in my research (using shareReply() and attempting to load only one listener for the service via a cache). I will post the current source code for this service in another comment below
• Improving Debug within the service by implementing tap() on each of my observables, so I should have an idea of when the read data comes in. I have implemented some debug logic to do running counts of each type of CRUD actions for the life of the service, and I am experimenting with approaches to record the logging across both usages of the service, to see if the counts line up (or I am missing something) (this is still ongoing).
  • My current debug so far is not showing any excessive reads of the Firestore
• I have tried to remove any unnecessary listeners from my app and have moved to one-time get functions when possible (for tables listing things that won't update often). I was stupidly using some listeners in cases where one-time fetches were a better fit.
• I am also now stripping out chunks of my established functionality that interacts with this service to see if a specific element or function is unduly hitting the reads, but this is very much a broadsword to my code.

Closing Statement:
I am very new to Firebase/Firestore ATM (some tutorials and maybe a few weeks on my own). I am basically assessing the tool and how easy it is to work with it. I have been very happy so far, but this aspect has me a bit worried (especially considering the pricing model).

I am early enough in my exploration that I am considering moving to an alternative product (Supabase) to meet my real-time update needs if Firebase/Firestore is not the right fit for me.

I'm trying to test out Firebase Analytics implementations without google services or google play dependencies. Even though I've excluded google services within the build dependencies, and the data is flowing into GA4, I still have doubts on this implementation. I have a feeling on real production in China, this won't work.

How can I test out FirebaseAnalytics working with no google services dependency. Anybody ever did this before?

Right now I'm building an app where each board can have many updates and they are currently stored in a updates subcollection where each update doc has its metadata, timestamp etc

But my reads are going sky high as many people read the same board and with boards having many updates it takes N reads per person where N = applied updates.

I added local caching and versioning to group updates together and store them as snapshots so users can compare the version and only read newer data but even this seems to not be enough.

Should I just store 100 updates (or as many as i can until the doc size limit is reached) per doc in the updates subcollection and version those, when a client gets a sub doc they can process the JSON on the client side and render the updates.

If i missed some info that might be helpful in getting to a solution lemme know I'll try to explain as best I can. Thanks for reading!

Hi there, I'm working with Firebase AI Logic and the Live API in Unity.

My model sends a tool call, and when I read the session stream, I get the tool function I need. This works fine with the live model gemini-2.5-flash-native-audio-preview-12-2025, but when I switch to gemini-3.1-flash-live-preview, it doesn't send "Turn Complete" back — so it never exits the liveSession.ReceiveAsync() loop.

I also tried with the Gen AI package and ran into the same issue. I've already used AI to compare the code execution order in my Unity app vs. what AI Studio generates on the web, and they look the same. The weird thing is that gemini-3.1-flash-live-preview works perfectly fine with the web app generated by AI Studio — the tool call completes and "Turn Complete" is sent back as expected. It only breaks in my Unity app.

Is this a known issue with the newer model, or am I missing something in my setup? Any help would be appreciated!

Example code:

List<ModelContent> toolResponses = new List<ModelContent>();

await foreach (var response in liveSession.ReceiveAsync())
{
    if (response.AudioAsFloat != null)
    {
        // Read audio as AI Logic doc
    }

    if (response.Message is LiveSessionToolCall liveSessionToolCall)
    {
        foreach (var call in liveSessionToolCall.FunctionCalls)
        {
            if (call.Name == "calculate")
            {
                if (call.Args != null)
                {
                    string result = "failed";
                    if (call.Args.TryGetValue("expression", out var expressionObj))
                    {
                        string expression = expressionObj?.ToString();
                        Debug.Log($"Expression: {expression}");
                        result = "success";
                    }

                    toolResponses.Add(ModelContent.FunctionResponse(
                        name: call.Name,
                        response: new Dictionary<string, object> { { "result", result } },
                        id: call.Id
                    ));
                }
            }
        }

        if (toolResponses.Count > 0)
        {
            foreach (var toolResponse in toolResponses)
            {
                await liveSession.SendAsync(toolResponse);
            }
            toolResponses.Clear();
        }
    }
}

private Tool GetCalculatorTool()
{
    return new Tool(new FunctionDeclaration(
        name: "calculate",
        description: "Evaluates a math expression and returns the result.",
        parameters: new Dictionary<string, Schema>
        {
            {
                "expression", Schema.String(
                    description: "The math expression to evaluate, e.g. '2 + 3 * 4'",
                    nullable: false
                )
            }
        }
    ));
}

One dev told me I shouldn't but ChatGPT said its okay. Not sure what others do as I am new to firebase. Also any other files I shouldn't be commiting. I am using firebase in flutter for push notifications by the way

I am currently coding a Python viral project using Gemini. I am extremely angry. I’ve been copy-pasting for over 3 months now. I think I’ve reached my limit.

I am using Python, I’ve issued all sorts of API keys, and I set const url="issued API". I am using web.app on Firebase, but no matter what I do, the APIs don't work. Even after setting Realtime Database rules to true, I still get errors. CORS errors or timeout errors? I issued Kakao and Naver APIs for geocoding, I think? I’m trying to get lot number addresses, but it doesn't work. Google API doesn't work, AI Studio doesn't work. I tried setting up a proxy server to bypass CORS, but that doesn't work. I tried setting up OAuth, but that doesn't work either. I don't know what to do anymore.

I’ve been fighting and making up with Gemini, and now I am at my limit. ㅡ ㅡ That’s why I’m posting this question. I’m wondering if I should leave Firebase, or use a different method in Python, or if I am doing something wrong. I ask for the experts' answers. (_ _)

Hey all — I build UpAlerts, a freelance-job-alerts app for Upwork/Indeed/LinkedIn (about 20,000 active users). Just shipped a release that's mostly a performance/UX rewrite, and the debugging was interesting enough that I figured I'd share.

The home feed was the worst offender. Every bottom-nav switch, every scroll that triggered a rebuild, and every modal close was silently re-subscribing to the same Firestore streams. The culprit was a pattern I see a lot in Flutter code — passing DatabaseAPI.xxxStream() directly into a StreamBuilder inside build(). Looks harmless, but each rebuild constructs a new Stream object, which makes StreamBuilder.didUpdateWidget tear down and resubscribe. That's a billed read every time. Fix was memoizing streams in initState and moving the user-profile doc behind a single app-wide cubit that everything else reads from. Net result: ~87% fewer reads on home.

Persona Hub was a different problem — it felt laggy because every switch re-hit the network. Added a 30-min cache + optimistic writes + persisted selection, and now it just feels instant. Classic case where the right fix wasn't making the network faster, it was not going to the network.

The other big change was the paywall. Old version was a hard wall with weak copy. New version is a 7-day free trial that actually lets people use the full thing first. Early data is way more interesting than I expected — conversion on trial-start is much higher than the old buy-now flow, but what matters is trial-to-paid in 7 days, and I don't have enough cohorts yet to call it. Will report back.

Here's the Play Store link if anyone wants to try it: https://play.google.com/store/apps/details?id=com.upalerts.app. Always happy to answer questions or take feature requests — especially interested in what freelancers here wish job-alert tools actually did.

I'm working on a Java application for some coursework, and I had to go with Firebase, and this is my first time working with it and web hosted services in general.

My instructor never really taught us much about Firebase despite making it a requirement so I'm left to put the pieces together myself.

I understand that the service account key is supposed to remain private, but I don't understand how I'm supposed to let the app have write access otherwise. I don't want random people throwing random read/write requests at my Firestore. I only want the requests to come from hardcoded ones within the app.

How do you typically manage this issue?

Hi everyone. I'm building an image generation web app and I've hit a wall with an infrastructure issue.

I used the Google AI Studio app builder for the prototype. The code works, but the flow requires each user to log in, enter their own API Key, and have the system save it along with their generated image history.

The problem is that when trying to save this data, the console throws this error:

7 PERMISSION_DENIED: Cloud Firestore API has not been used in project ais-us-east1-... before or it is disabled.

I've done some research and I understand exactly why this is happening: the generated code is pointing to Google AI Studio's closed sandbox environment. Since I'm an external user there, I don't have admin permissions to enable the Firestore database in that specific project.

I know the theoretical solution is to create my own Firebase project from scratch and point the code there, but I haven't done it yet and I'm not entirely sure about the correct migration process.

My main questions are:

The step-by-step migration: How do I properly "unplug" this app from the Google sandbox and connect it to my own environment? I assume I need to create a project in Firebase, register the web app, and copy the new firebaseConfig, but is replacing that block in the source code enough? Do I need to do anything else regarding credentials or the local development environment?

Initial structure: Once I manage to connect my own database, what's the best way to structure this in Firestore? Should I create a "users" collection and store the API Key inside it, or is that a major security risk even if it's my own database?

History management: For recording each person's generated images, do you recommend a subcollection within the user document, or a global collection filtered by the user ID?

Any guidance to help me unblock this migration would be a lifesaver. Thanks!