The Firebase web config (including apiKey) is a public identifier, not a secret. Data is protected by Firestore, Realtime Database, and Storage Security Rules plus App Check. Admin SDK service account JSON bypasses rules and must only exist on servers.
Identifies your project. Restrict it to required APIs in Google Cloud Console.
Full admin access that ignores Security Rules.
Send push notifications to any device in your project.
Require request.auth and match document ownership in rules for Firestore, Realtime Database, and Storage.
App Check makes it harder for scripts outside your app to call your Firebase backends.
Use verifyIdToken in trusted code before acting on a user identity sent from the client.
Rules like allow read, write: if true expose your entire database to anyone with the config.
It grants admin access that bypasses every rule you wrote.
The config is visible in every client. Only rules and App Check protect data.
Put service account credentials in the vault and expose aggregated or admin reads as edge pipelines. Clients keep using the Firebase SDK under Security Rules for user-owned data.
No. It identifies the project and is safe to ship. Security Rules and App Check are what prevent abuse.
You should not store Firebase credentials in Next.js / React client code. Store service account JSON in Vault; Next.js routes call RealComposer instead of Firebase Admin SDK in serverless bundles. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
You should not store Firebase credentials in React Native client code. Client uses anon rules; privileged reads run through edge proxy with Firebase tokens injected. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
To combine firebase auth user with supabase profile endpoint, use one RealComposer pipeline with parallel steps. Firebase ID token lookup and Supabase profile row merged at edge. Your React / Flutter / Mobile app makes one request instead of several sequential upstream calls.
To stitch firebase with clerk session bootstrap, use one RealComposer pipeline with parallel steps. Clerk session and Firebase FCM registration merged at startup. Your React Native app makes one request instead of several sequential upstream calls.
Firebase payloads are heavy for Flutter / React Native / Swift. Strips document names revision metadata and map noise at edge. RealComposer output mapping returns only the fields your UI needs at the edge.
Firebase payloads are heavy for React Native. Remove refresh tokens providerData internals at edge. RealComposer output mapping returns only the fields your UI needs at the edge.
Service account credentials are non-human identities, such as Firebase Admin service account JSON or a Supabase service role key, used by backend systems to access APIs with elevated privileges. They often bypass user-level security rules, so exposure grants full administrative access.
Principle of Least PrivilegeThe principle of least privilege states that every user, service, and credential should have only the minimum permissions required to perform its task. For APIs, this means using restricted keys, narrow OAuth scopes, and client tokens limited to specific endpoints.
Bot ProtectionBot protection is detecting and blocking automated traffic that abuses websites and APIs, such as scrapers, credential stuffing tools, and fake signup scripts, while allowing legitimate users and good bots like search crawlers. It combines fingerprinting, behavior analysis, and challenges.