When you're ready to launch your app and have real end users interact with your
app's AI features, make sure to review this checklist of best practices and
important considerations.

- [**General**](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#general)

  - [Review the general launch checklist](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#review-launch-checklist)
  - [Follow best practices for Firebase projects](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#projects-follow-best-practices)
- [**Access and security**](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#access-and-security)

  - [Review security checklists](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#review-security-checklists)
  - [Enforce Firebase App Check with limited-use tokens](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#enforce-app-check)
  - [Set up restrictions for your Firebase API keys](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#set-up-api-key-restrictions)
  - [Restrict requests to only authenticated users](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#auth-mode)
- [**Monitoring, limits, and billing**](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#monitoring-limits-billing)

  - [Set up AI monitoring in the Firebase console](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#ai-monitoring)
  - [Set rate limits and manage quotas](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#rate-limits-and-quotas)
  - [Avoid surprise bills with alerts and spend caps](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#avoid-surprise-bills)
- [**Management of configurations**](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#manage-configurations)

  - [Use a stable model version in your production app](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#use-stable-model-version)
  - [Use Firebase Remote Config or server prompt templates](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#remote-config)
  - [Set the location for accessing the model](https://firebase.google.com/docs/ai-logic/production-checklist.md.txt#set-location)

> [!IMPORTANT]
> **Key Point:** You can complete many of these checklist items as soon as you start developing your app and well before launch.  
> **Most importantly, it's *critical* that you enforce
> [Firebase App Check](https://firebase.google.com/docs/ai-logic/app-check.md.txt)
> as well as use
> [Firebase Remote Config](https://firebase.google.com/docs/ai-logic/solutions/remote-config.md.txt) or
> [server prompt templates](https://firebase.google.com/docs/ai-logic/server-prompt-templates/get-started.md.txt)
> so that you can make on-demand changes to configurations for your AI feature
> without releasing a new version of your app.**

## General

### Yes Review the general launch checklist

Review the [Firebase launch checklist](https://firebase.google.com/support/guides/launch-checklist.md.txt) for
important best practices before launching any Firebase app to production.

### Yes Follow best practices for Firebase projects

Use separate Firebase projects for development, testing, and production. Review
more best practices for
[managing your projects](https://firebase.google.com/support/guides/launch-checklist.md.txt#projects-follow-best-practices).

## Access and security

[Video](https://www.youtube.com/watch?v=YoZhjftm6v4)

### Yes Review security checklists

Review the [Firebase security checklist](https://firebase.google.com/support/guides/security-checklist.md.txt) and
the dedicated
[Security checklist for Firebase AI Logic](https://firebase.google.com/docs/ai-logic/security-checklist.md.txt)
for important best practices for access and security.

### Yes *Enforce* Firebase App Check

**Enforce [Firebase App Check](https://firebase.google.com/docs/ai-logic/app-check.md.txt)** to help protect
the Gemini API from abuse when it's called directly from your app. When
App Check is enforced, it verifies that incoming requests originate from
your authentic app and/or an untampered device.

App Check supports attestation providers for
Apple platforms (DeviceCheck, App Attest, or reCAPTCHA Enterprise),
Android (Play Integrity or reCAPTCHA Enterprise), and
Web (reCAPTCHA Enterprise). It supports all these providers for Flutter
and Unity apps, too.

Also, consider **enforcing
[*replay protection*](https://firebase.google.com/docs/ai-logic/app-check.md.txt#replay-protection)** , which means
tokens are *one-time-use only*. This option offers enhanced protection beyond
the baseline protection and lets you set an appropriate level of protection for
your app and use cases.

> [!WARNING]
> **Warning:** **Starting November 2, 2026, Firebase App Check
> enforcement will be *required* to use Firebase AI Logic.** [Learn more.](https://firebase.google.com/docs/ai-logic/faq-and-troubleshooting.md.txt#security-app-check)

### Yes Set up restrictions for your Firebase API keys

Firebase API keys identify your Firebase project and app when making requests.
To prevent unauthorized use of your API keys:

- Set
  ["Application restrictions"](https://cloud.google.com/docs/authentication/api-keys#adding_application_restrictions)
  in the Google Cloud console to limit key usage to only requests from your
  app's specific bundle ID (Apple),
  package name and SHA-1 fingerprint (Android), or HTTP referrer (Web).

- Review each key's
  ["API restrictions"](https://cloud.google.com/docs/authentication/api-keys#adding_api_restrictions)
  allowlist:

  - Ensure that Firebase AI Logic API (`firebasevertexai.googleapis.com`) is in the allowlist.
  - Ensure that the only other APIs on the allowlist are the specific Firebase services required by your app. See the [list of required APIs for restricted Firebase keys](https://firebase.google.com/docs/projects/api-keys.md.txt#faq-required-apis-for-restricted-firebase-api-key).

Note that Firebase-related APIs use API keys only to *identify* the Firebase
project or app, *not for authorization* to call the API.

### Yes Restrict requests to only authenticated users

Consider **enforcing [*authenticated-users mode*](https://firebase.google.com/docs/ai-logic/auth-mode.md.txt)** so
that all requests via Firebase AI Logic must include valid credentials from
[Firebase Authentication](https://firebase.google.com/docs/auth.md.txt). If a request comes from an unauthenticated end
user, the request is rejected with a `401: unauthenticated` error.

## Monitoring, limits, and billing

### Yes Set up AI monitoring in the Firebase console

**Set up
[AI monitoring in the Firebase console](https://firebase.google.com/docs/ai-logic/monitoring.md.txt#ai-monitoring-in-console)**
to gain visibility into key performance metrics, like request counts, latency,
token usage, and error rates. You can also inspect individual traces in the
Google Cloud console.

### Yes Set rate limits and manage quotas

Protect your project from unexpected usage spikes and denial-of-wallet attacks:

- [Set rate limits per user](https://firebase.google.com/docs/ai-logic/quotas.md.txt#per-user-rate-limits) (default is 100 RPM) to prevent individual client instances from consuming excessive quota.
- [Review and manage project quotas](https://firebase.google.com/docs/ai-logic/quotas.md.txt#edit-quota-or-request-quota-increase) in the Google Cloud console for each underlying API.

### Yes Avoid surprise bills with alerts and spend caps

If your Firebase project is on the pay-as-you-go Blaze pricing plan:

- [Monitor your usage.](https://firebase.google.com/docs/ai-logic/monitoring.md.txt)

- Set up
  [**budget alerts**](https://firebase.google.com/docs/projects/billing/budget-alerts.md.txt)
  and
  [**spend caps**](https://firebase.google.com/docs/projects/billing/spend-caps.md.txt).

## Management of configurations

### Yes Use a stable model version in your production app

In your production app, only use
[*stable* model versions](https://firebase.google.com/docs/ai-logic/models.md.txt#versions) (like
`gemini-3.8-flash`). Do ***not*** use a *preview* or
*experimental* version or a `-latest` alias.

> [!IMPORTANT]
> **Important:** We *strongly* recommend using [Firebase Remote Config](https://firebase.google.com/docs/ai-logic/change-model-name-remotely.md.txt) or [server prompt templates](https://firebase.google.com/docs/ai-logic/server-prompt-templates/get-started.md.txt) so that you can make on-demand changes to the model name used for your AI feature without releasing a new version of your app. (see next section).

### Yes Use Firebase Remote Config or server prompt templates

When you use Remote Config or server prompt templates, you can control
important configurations for your app's AI features *in the cloud (server-side)*
rather than hard-coding values in your code. This means that you can update your
configurations without releasing a new version of your app.

- *(Strongly recommended)* Make on-demand changes to the model name used for
  your AI feature as new models are released or others are shut down.
  See details for using
  [Remote Config](https://firebase.google.com/docs/ai-logic/change-model-name-remotely.md.txt) or
  [server prompt templates](https://firebase.google.com/docs/ai-logic/server-prompt-templates/get-started.md.txt).

- *(Optional)* Dynamically and even conditionally control other parameters for
  your AI feature, for example the model configuration (like max output tokens),
  safety settings, system instructions, and prompt data.
  See details for using
  [Remote Config](https://firebase.google.com/docs/ai-logic/solutions/remote-config.md.txt) or
  [server prompt templates](https://firebase.google.com/docs/ai-logic/server-prompt-templates/get-started.md.txt).

- *(Optional)* [Set a `minimum_version` parameter](https://firebase.google.com/docs/remote-config/use-cases/minimum-version.md.txt)
  in Remote Config to compare the app's current version with the
  Remote Config-defined latest version, to either show an upgrade
  notification to users or force users to upgrade.

### Yes Set the location for accessing the model


|---|
| *Only available when using the Agent Platform Gemini API (formerly Vertex AI) as your API provider.* |

<br />

[Set a location for accessing the model](https://firebase.google.com/docs/ai-logic/locations.md.txt?api=vertex)
to help optimize quota and prevent latency for your users.

If you don't specify a location, the default is `global` (when using the new
"Agent Platform" initialization syntax). You can set this location during
initialization, or optionally
[use Firebase Remote Config to dynamically change the location based on each user's location](https://firebase.google.com/docs/ai-logic/solutions/remote-config.md.txt).