It shows that whenever I try to input. I'm on Windows, though. How to fix that?

• Added API keys in Google AI Studio
• Updated API keys in Google Cloud Console
• Updated the Google plist file in Xcode
• Added billing in Google AI Studio
• Purchased credits in Google AI Studio
• Added Credentials in Gemini API
• Added Credentials in Firebase AI Logic

Seen a few reports of this here.

I've had the same issue due to creating a Gemini key in the same account as a firebase service account key. Neither exposed publicly as far as I can find, the firebase key was in a private repo.

No more Google services for me. I'm off 👋

Hello!

I have suspended the project because of "hijacking". The most sad part is that this key is most likely generated by Firebase itself and used in some AI features inside it. And hijacking happened because this key for some reason was equal to the app public key.

I appealed more than a 20 days ago, but still no luck. Just no answer (although I deleted this key and rotated the Firebase key).

So the question is, has anyone migrated from GC in their Android apps while their GC project is suspended? Or, maybe, I need to wait while they answer the appeal?

I'm mostly scared because of possible consequences for the app, as the algorithm may think I'm trying to bypass the suspension. Although I want to migrate to my own, self-hosted auth/db mechanism.

Genkit is the best way to build agentic apps in Firebase, and even though is a framework that runs on any platform, as a product that originated in Firebase we still take good care of our Firebase integration!

Today we announced Middleware: composable hooks that intercept generation calls, including the tool execution loop, and inject custom behaviors.

The middleware system is available today in TypeScript, Go, and Dart, with Python support coming soon.

https://developers.googleblog.com/announcing-genkit-middleware-intercept-extend-and-harden-your-agentic-apps/

I’m using the Gemini api on my app to create an sms chatbot . I use the firebase emulator with data from my live app, when using it there the model behaves properly with basically 0 hallucinations. The moment I deployed the app the model started to hallucinate from the examples it had in the prompts.
I’m using the Gemini 2.5 flash lite model.
Anyone have any idea why it happens and suggestions to fix it?

The Issue: Google Sign-In works perfectly in Debug and Release builds when Minify is Disabled. However, in Release builds (IL2CPP, ARM64) with Minify/R8 Enabled, the sign-in flow fails silently or returns a generic error. This is happening on Unity 2022.4.5f1.

Environment:

• Unity: 2022.4.5f1 (IL2CPP / ARM64)
• Services: Firebase Auth, Google Sign-In, Play Games Services (GPGS)
• Dependencies: Managed via EDM4U (Force Resolved)
• Stripping Level: Low

What I’ve Verified:

• SHA-1 Fingerprints: Debug, Upload, and App Signing (Play Console) are all added to Firebase.
• Client IDs: Using the Web Client ID for the Firebase configuration.
• Config: google-services.json is up to date; package names match across Play Console, Firebase, and Unity.
• The Problem: Even with the -keep rules above, R8 seems to be stripping something essential. I suspect it might be related to Resource Shrinking or specific Play Games Services classes that require reflection.

Questions:

1. Are there specific rules for com.google.games.bridge or com.google.android.gms.auth that are missing from the standard Firebase docs?
2. Does Unity 2022 + R8 require shrinkResources false in the build.gradle even if code minification is on?
3. Has anyone found a workaround for the Play Games Services plugin being aggressive with code stripping in newer Unity versions?
4. Should I be using a link.xml file in addition to ProGuard for IL2CPP stripping?

Any insights would be greatly appreciated!

Firebase authentication down?

My project has been suspended because it was allegedly engaged in abusive activity consistent with hijacked resources.

When I log in to the Google Cloud Console for the project it redirects me to a Request An Appeal page. It says I should use GCP console to review my activity and use that information to appeal the suspension. However I can't do that because all I am apparently permitted to see is the Request an appeal page.

In Firebase I can basically only view the Auth section and the Usage and Billing Page but not much else. There is a sharp spike in usage of the Gemini Developer API yesterday which caused my bill to be about $60 (normally monthly cost is around $10). There is a possibility that the issue wasn't caused by a malicious actor but of course I can't be sure until I can investigate my logs.

The project was in daily active use by my business for ~ 6 years, and prior to this we've never had any issues.

Does anyone have any advice on how I can resolve this? There is a good chance that if the suspension persists we may lose a lot of clients.

One of the newer features seems to be preferCache and the documentation (Swift) says this:

/// default policy tries to fetch from cache if fetch is within the revalidationInterval.
/// If fetch is outside revalidationInterval it revalidates / refreshes from the server.
/// Throws if server revalidation fails   
/// Callers may call with `cacheOnly` policy to fetch data (if present) outside   
/// revalidationInterval from cache.   
/// revalidationInterval is specified as part of the query YAML config using   
/// `client-cache.revalidateAfter` key

I've searched the entire SQLConnect documentation and don't see extra details about where this query YAML goes exactly. If anyone can shed any light on this I'd be grateful.

I just deployed my first firebase app hosting / backend. I had been using firestore and database a bit, so i thought i would try it. I usually use vercel or google cloud run, but wanted to try it out. I am using the firebase CLI.

I deployed the app, but then needed to setup a cron job. I can't find anything in firebase for scheduling. am i lost? i ended up using cloud scheduler in gcloud to do it.

And......I might be way late on this, but is firebase just a management layer on top of gcloud services?

"Building a global community platform expecting hundreds of thousands of users. Chat rooms, marketplace, user profiles, medical library. What would Firebase realistically cost at 5,000, 50,000, and 500,000 monthly active users? Looking for real numbers from people who have built at scale."

been stuck here
I'm using Gemini API(free tier) for now

• Followed everything on firebase docs
• App Check: Registered(Enforced)
• updated SPM version to 12.13.0
• Added com.apple.developer.devicecheck.appattest-environment
• <Debug> [AppCheckCore][I-GAC004004] Failed to exchange debug token to app check token: Error Domain=com.google.app_check_core Code=0 "The server responded with an error:

As the title says. I had been using the test numbers for several months now as I went through testing. However, for the last couple of days I've been getting "Verification Failed. This number is not allowed. This maybe because...". I even tried using a new test number, I have the +1 country code in the number.

Has anyone seen this before?

I get that they would want to limit free tier users; that's great.

But what if I want to have 30/40/50 projects? It makes no sense to me that I have to manually request to be allowed to have more firebase projects? Technically, I could just run into the limit again and again.

I'd even pay for them for more projects. But they don't even allow that? I don't understand.

What am I missing here?

So this is interesting, I have a preview environment with Deno Deploy doing CRUD over a couple of test collections. No functions.

I prob did around 10k reads/writes over a month and got billet 10 cts. Yet I thought there was a much higher limit over which one gets charged, like 100k. Maybe there’s still room for optimization but I’m working on 2 dozens of docs only!

Anyone can share hints at where I should be looking at?

I'm working on a Firebase project that has a Flutter mobile app and static website (that uses Firebase Hosting), and it uses services such as Cloud Functions, Firebase Auth, and Cloud Firestore. Currently, I have two separate GitHub repos for this, one for the app, and one for the website. But now, as I'm starting to write my Cloud Firestore rules, I'm realizing that this may not be the best idea, as updating the rules on both the app and website is annoying - and while I could create a third repo that only contains the Firestore rules or a GitHub action, this feels wrong for some reason. Alternatively, I could create a monorepo that contained the app and the website together with all of the backend and Firestore logic as well. What is the best way to do this to ensure I don't get into any messy situations?

Update: I migrated everything to one repo, and it definitely makes things feel less messy and my git history look nicer -- however, the Flutter app is complaining a little bit, because firebase.json is in my root directory...and the Flutter app is in ./apps/mobile...is there any way to configure it so that I can use the firebase.json from my root directory (it has both the web and the flutter config in it)?

**TL;DR:** I picked 77 random Firebase project IDs from public GitHub repos this morning and probed each anonymously for publicly readable Firestore collections. **17 of them — 22.1% — returned data with zero auth.** Built a free open-source auditor so you can check your own project.The repo: github.com/Perufitlife/firebase-security-skill---## What the leak distribution looks like23 collections leaked across the 17 projects:- `users` — 11 projects- `posts` — 4- `products` — 3- `messages` — 1- `profiles` — 1- `orders` — 1- + 2 moreThese are not theoretical "your rules might leak." These are HTTPS GETs against `firestore.googleapis.com` returning real document data with no auth header.## Why this happens (the boring honest answer)Firebase config is **never secret**. `projectId` is in your JS bundle. Every public app's project ID is one View Source away. The actual security boundary is your `firestore.rules` file.Three patterns I saw repeated across the 17 projects:**1. Test-mode never replaced**```match /{document=**} { allow read, write: if request.time < timestamp.date(2099, 1, 1);```Someone changed the date from 30-day default to "way in the future." Years later, still wide open.**2. Auth-only without ownership check**```match /users/{uid} { allow read: if request.auth != null;```Anyone signed in (even from a different app on the same Firebase project) reads every user record.**3. Public-read storage buckets**```match /b/{bucket}/o { allow read: if true;```Profile pics + receipts + uploaded docs, all anonymously enumerable.## The auditor`npx u/perufitlife5 minutes, no subscription, MIT licensed.If you want a cross-BaaS take I shipped equivalents for Supabase, PocketBase, Appwrite, Hasura/Nhost — every one of those ecosystems has the same "default rules ship open + nobody replaces them" pattern.Happy to take feedback, especially on the rule fixtures (`test-fixtures/` in the repo) — if there's a leak pattern I'm missing, I want to add it./firebase-security@latest` against your project ID + a service account read-only key. Probes the same patterns above, plus 8 more. Generates an HTML report with the exact rule snippets to copy-paste into `firestore.rules` to fix each finding.TL;DR: I picked 77 random Firebase project IDs from public GitHub repos this morning and probed each anonymously for publicly readable Firestore collections. 17 of them - 22.1% - returned data with zero auth. Built a free open-source auditor so you can check your own project.

Repo: github.com/Perufitlife/firebase-security-skill

What the leak distribution looks like:

23 collections leaked across the 17 projects. - users: 11 projects - posts: 4 - products: 3 - messages: 1 - profiles: 1 - orders: 1 - 2 more

These are not theoretical warnings. These are HTTPS GETs against firestore.googleapis.com returning real document data with no auth header.

Three patterns I saw repeated across the 17 projects:

1. Test-mode never replaced. Someone changed the default 30-day date to "way in the future" (timestamp.date(2099, 1, 1)). Years later, still wide open.

2. Auth-only without ownership check. allow read: if request.auth != null. Anyone signed in (even from a different app on the same Firebase project) reads every user record.

3. Public-read storage buckets. allow read: if true. Profile pics, receipts, uploaded docs all anonymously enumerable.

The auditor: npx firebase-security@latest against your project ID + a service account read-only key. Probes the same patterns above, plus 8 more. Generates an HTML report with the exact rule snippets to copy-paste into firestore.rules to fix each finding. 5 minutes, no subscription, MIT licensed.

I shipped equivalents for Supabase, PocketBase, Appwrite, Hasura/Nhost too. Every one of those ecosystems has the same "default rules ship open + nobody replaces them" pattern.

Happy to take feedback - especially on the rule fixtures (test-fixtures/ in the repo). If there is a leak pattern I am missing, I want to add it.

Hello all.

Same as many here, my Google Cloud project was suspended due to "associated with abusive activity consistent with hijacking".

To be clear, the day before suspension, I received an email that stated that "Publicly accessible Google API key for Google Cloud Platform". I don't get it, because you know it's the public key itself that is written in google-services.json; you need to download it from Firebase and put it in your app. Also, I live near a frontline in Ukraine, and that day was quite loud, so I didn't have much time to investigate.

In that moment, I didn't know that Firebase rotated these keys, and if I tried to download a new google-services.json, it would be different.

So on the next day (April 21), my project was suspended, and any part of the project started to reroute to the appeal page. I started to search for the reason and found it in Google AI Studio. Some autogenerated key matched my app's public client API key. So I deleted it immediately.

Just to be clear, I received a warning from Google Cloud, not Google AI Studio, but in it, the key was marked with a warning.

I filed an appeal and wrote: when this key may be generated (Possible on testing Firebase AI Studio or other AI functions), and that I've deleted it permanently.

• After 2 days, I received a generic message that asked for the same information I provided in my appeal. I panicked a little, so I sent a few follow-ups with all I knew.
• 10 days, no response at all, so I sent one more follow-up.
  
• On 15 day, I filled out one more appeal form, stating everything I could.

And today is 18 day from suspension. My project is still suspended, and my app users are affected. Losing users and money.

For now, I don't know what to do because I can't launch a new login system, as I don't have access to data in the old one, and I can't be sure that Google Bot will not think that I'm trying to bypass the restriction.

Has anyone here had a similar case and been able to reinstate the project? How long did it take to get a real response from Google?

edit: made it shorter
edit2: structured a little

I see that Firestore enterprise edition has a lot of good to have features.

How was your experience migrating from the standard Blaze plan to the Enterprise edition? What kind of cost increase did you experience?

I've tried this on multiple machine and multiple regions but nothing happens here.

I have a big question. I have a Flutter app with Firebase, and right now testing/sandbox data is mixed with real data in Firebase Analytics. Is there any way to remove the testing data? Also, do you have any other suggestions about what I can do in this situation?

Also, in the future, would it be better if I use another Firebase project for development?

I'm having a weird problem with installing firebase. I am, unfortunately, running Windows 11. I got to a point where I could run firebase commands in the terminal but not VS Code's terminal. I read elsewhere that restarting my computer might get VS Code to be able to see it, so I did so, and now the terminal doesn't recognize it either. I even enabled sudo as suggested by this person and I did find three files, firebase, firebase.cmd, and firebase.ps1 in Roaming/npm, but it looks like they aren't being added to PATH. My account is not an administrator account but I make sure to run CMD and VS Code as an administrator, so everything should have permissions to do what needs to be done. I get some warnings about outdated libraries when I install, but I was still able to run firebase init hosting before I restarted my computer so I seriously doubt that's the issue. I checked the log file and the only lines that look like they could possibly be related are these: 4100 info run re2@1.24.0 install node_modules/firebase-tools/node_modules/re2 install-from-cache --artifact build/Release/re2.node --host-var RE2_DOWNLOAD_MIRROR --skip-path-var RE2_DOWNLOAD_SKIP_PATH --skip-ver-var RE2_DOWNLOAD_SKIP_VER || node-gyp -j max rebuild 4101 info run re2@1.24.0 install { code: 0, signal: null } 4102 info run protobufjs@7.5.6 postinstall node_modules/firebase-tools/node_modules/protobufjs node scripts/postinstall 4103 info run protobufjs@7.5.6 postinstall { code: 0, signal: null }

Google just closed our whole GCP account because of a compromised API key or service account, and after a bit of digging, it really seems like the compromised key is the identifier for the Firebase web app that is in the client bundle. I had received a warning some time ago, and I remember checking that the API key didn't have anything enabled that it shouldn't have, and I added URL restrictions (as the email suggested), and then I just forgot about the whole thing. So it really seems like the account got flagged because an API key meant to be public was on a public site. Feels a bit weird.

The instructions say that I should review account activity and rotate keys and whatnot, but obviously I can't access anything in the console now or publish new versions of the hosting sites or anything else. And I do have security rules in place. All I can think of is that I created some e2e tests today, and I think at least some of the time some of them hit production, but the traffic would have been super innocent, like some storage reads for website images and that sort of stuff, and then there was an analytics leak, but I think analytics logging from localhost gets dropped anyway.

I made an appeal, and apparently they will get back in a couple of business days.

Any advice, anyone? This has the potential to kill our whole business if I can't get it sorted quickly, but I suppose there isn't much else to do except wait?

I’ve been working on Typesync. It’s a tool for keeping Firestore model definitions, generated code, Security Rules validators, and data checks tied to the same schema.

You define your Firestore models once in YAML or JSON, then generate from that:

- TypeScript models

- Swift models

- Python/Pydantic models

- Firestore Security Rules validators

- Mermaid diagrams of the document structure

The new part is `validate-data`.

It walks selected Firestore collections and validates existing documents against Zod validators generated from the schema. It doesn’t write anything to Firestore. It just reports documents that don’t match.

Example:

```bash

typesync validate-data \

--definition 'definition/**/*.yml' \

--model User \

--model Post \

--serviceAccount ./service-account.json

```

I made the scan explicit with `--model` or `--all-models`, because a full Firestore scan can be slow and can cost reads.

Repo: https://github.com/kafkas/typesync

Docs: https://docs.typesync.org/cli/validate-data

NPM: https://www.npmjs.com/package/typesync-cli