Security checklist for using Firebase AI Logic

When you call the Gemini API directly from your mobile and web apps, protecting your backend infrastructure, quota, and proprietary prompts requires a multi-layered defense-in-depth approach. Review this checklist to implement recommended security best practices for Firebase AI Logic.

App, device, and user verification

Verify that incoming requests originate from legitimate, untampered instances of your app running on authentic devices, as well as from authentic users.

Enforce Firebase App Check

Enforce Firebase App Check to help protect the Gemini API from abuse when it's called directly from your app. When App Check is enforced, it verifies that incoming requests originate from your authentic app and/or an untampered device.

App Check supports attestation providers for Apple platforms (DeviceCheck, App Attest, or reCAPTCHA Enterprise), Android (Play Integrity or reCAPTCHA Enterprise), and Web (reCAPTCHA Enterprise). It supports all these providers for Flutter and Unity apps, too.

Starting in early July 2026, Firebase automatically enforces App Check for Firebase AI Logic during the guided setup in the Firebase console. If you set up Firebase AI Logic earlier, make sure to enforce App Check explicitly. For local development, you can set up the App Check debug provider, and then register your app with a production attestation provider before releasing to end users.

Enable replay protection with limited-use tokens

As part of setting up App Check, consider enforcing replay protection so that App Check tokens are one-time-use only. This option offers enhanced protection beyond the baseline protection and lets you set an appropriate level of protection for your app and use cases.

Set up restrictions for your Firebase API keys

Firebase API keys identify your Firebase project and app when making requests. To prevent unauthorized use of your API keys:

  • Set "Application restrictions" in the Google Cloud console to limit key usage to only requests from your app's specific bundle ID (Apple), package name and SHA-1 fingerprint (Android), or HTTP referrer (Web).

  • Review each key's "API restrictions" allowlist:

    • Ensure that Firebase AI Logic API (firebasevertexai.googleapis.com) is in the allowlist.
    • Ensure that the only other APIs on the allowlist are the specific Firebase services required by your app. See the list of required APIs for restricted Firebase keys.

Note that Firebase-related APIs use API keys only to identify the Firebase project or app, not for authorization to call the API.

Restrict requests to only authenticated users

Consider enforcing authenticated-users mode so that all requests via Firebase AI Logic must include valid credentials from Firebase Authentication. If a request comes from an unauthenticated end user, the request is rejected with a 401: unauthenticated error.

Prompt protection and request hardening

Prevent client decompilation from exposing your prompt designs, and lock down your backend so malicious users cannot execute arbitrary prompts.

Use server prompt templates

Use server prompt templates to keep prompts, system instructions, and model configurations securely in the cloud, rather than hard coding them in client app code where they can be extracted using binary decompilation.

Your app only references a template ID and passes dynamic input variables. Server prompt templates also let you update prompts or switch models on demand without releasing a new version of your app.

Validate and sanitize client-provided template variables

Server prompt templates protect your prompt design, but templates that accept dynamic variables can still be susceptible to prompt injection. Because templates concatenate user input variables into the final prompt, make sure to do the following:

  • Validate and sanitize all user input on the client before passing variables to a template (such as enforcing character limits and expected formats).
  • Include clear system instructions in your templates that define guardrails for how user input is processed.

Enforce template-only mode

Consider enforcing template-only mode once all your app features use server prompt templates. When enforced, Firebase AI Logic blocks all direct, un-templated requests to the Gemini API (403: unauthorized), preventing malicious actors from sending arbitrary prompts or abusing your quota.

Monitoring, limits, and billing

Gain visibility into incoming traffic and security anomalies, and protect your project from unexpected usage spikes or runaway costs.

Set up AI monitoring in the Firebase console

Set up AI monitoring in the Firebase console to gain visibility into key metrics, like request counts, latency, token usage, and error rates (including 401 auth failures and 403 template-only blocks). You can also inspect individual traces in the Google Cloud console.

Set rate limits and manage quotas

Protect your project from unexpected usage spikes and denial-of-wallet attacks:

Avoid surprise bills with alerts and spend caps

If your Firebase project is on the pay-as-you-go Blaze pricing plan:

Next steps