Production checklist for using Firebase AI Logic

When you're ready to launch your app and have real end users interact with your app's AI features, make sure to review this checklist of best practices and important considerations.

• General

  • Review the general launch checklist
  • Follow best practices for Firebase projects

• Access and security

  • Review security checklists
  • Enforce Firebase App Check with limited-use tokens
  • Set up restrictions for your Firebase API keys
  • Restrict requests to only authenticated users

• Monitoring, limits, and billing

  • Set up AI monitoring in the Firebase console
  • Set rate limits and manage quotas
  • Avoid surprise bills with alerts and spend caps

• Management of configurations

  • Use a stable model version in your production app
  • Use Firebase Remote Config or server prompt templates
  • Set the location for accessing the model

General

Review the general launch checklist

Review the Firebase launch checklist for important best practices before launching any Firebase app to production.

Follow best practices for Firebase projects

Use separate Firebase projects for development, testing, and production. Review more best practices for managing your projects.

Access and security

Review security checklists

Review the Firebase security checklist and the dedicated Security checklist for Firebase AI Logic for important best practices for access and security.

Enforce Firebase App Check

Enforce Firebase App Check to help protect the Gemini API from abuse when it's called directly from your app. When App Check is enforced, it verifies that incoming requests originate from your authentic app and/or an untampered device.

App Check supports attestation providers for Apple platforms (DeviceCheck, App Attest, or reCAPTCHA Enterprise), Android (Play Integrity or reCAPTCHA Enterprise), and Web (reCAPTCHA Enterprise). It supports all these providers for Flutter and Unity apps, too.

Also, consider enforcing replay protection, which means tokens are one-time-use only. This option offers enhanced protection beyond the baseline protection and lets you set an appropriate level of protection for your app and use cases.

Set up restrictions for your Firebase API keys

Firebase API keys identify your Firebase project and app when making requests. To prevent unauthorized use of your API keys:

• Set "Application restrictions" in the Google Cloud console to limit key usage to only requests from your app's specific bundle ID (Apple), package name and SHA-1 fingerprint (Android), or HTTP referrer (Web).

• Review each key's "API restrictions" allowlist:

  • Ensure that Firebase AI Logic API (firebasevertexai.googleapis.com) is in the allowlist.
  • Ensure that the only other APIs on the allowlist are the specific Firebase services required by your app. See the list of required APIs for restricted Firebase keys.

Note that Firebase-related APIs use API keys only to identify the Firebase project or app, not for authorization to call the API.

Restrict requests to only authenticated users

Consider enforcing authenticated-users mode so that all requests via Firebase AI Logic must include valid credentials from Firebase Authentication. If a request comes from an unauthenticated end user, the request is rejected with a 401: unauthenticated error.

Monitoring, limits, and billing

Set up AI monitoring in the Firebase console

Set up AI monitoring in the Firebase console to gain visibility into key performance metrics, like request counts, latency, token usage, and error rates. You can also inspect individual traces in the Google Cloud console.

Set rate limits and manage quotas

Protect your project from unexpected usage spikes and denial-of-wallet attacks:

• Set rate limits per user (default is 100 RPM) to prevent individual client instances from consuming excessive quota.
• Review and manage project quotas in the Google Cloud console for each underlying API.

Avoid surprise bills with alerts and spend caps

If your Firebase project is on the pay-as-you-go Blaze pricing plan:

• Monitor your usage.

• Set up budget alerts and spend caps.

Management of configurations

Use a stable model version in your production app

In your production app, only use stable model versions (like gemini-3.7-flash). Do not use a preview or experimental version or a -latest alias.

Use Firebase Remote Config or server prompt templates

When you use Remote Config or server prompt templates, you can control important configurations for your app's AI features in the cloud (server-side) rather than hard-coding values in your code. This means that you can update your configurations without releasing a new version of your app.

• (Strongly Recommended) Make on-demand changes to the model name used for your AI feature as new models are released or others are shut down. See details for using Remote Config or server prompt templates.

• (Optional) Dynamically and even conditionally control other parameters for your AI feature, for example the model configuration (like max output tokens), safety settings, system instructions, and prompt data. See details for using Remote Config or server prompt templates.

• (Optional) Set a minimum_version parameter in Remote Config to compare the app's current version with the Remote Config-defined latest version, to either show an upgrade notification to users or force users to upgrade.

Set the location for accessing the model

Only available when using the Agent Platform Gemini API (formerly Vertex AI) as your API provider.

Set a location for accessing the model to help optimize quota and prevent latency for your users.

If you don't specify a location, the default is global (when using the new "Agent Platform" initialization syntax). You can set this location during initialization, or optionally use Firebase Remote Config to dynamically change the location based on each user's location.