Skip to main content
UNPWNED
Scan free
Firebase Security Guide
Q&AFirebase

Is the Firebase API key a secret?

The Firebase API key is not a secret and is designed to be included in client-side code. It serves as a project identifier rather than an authentication credential. Access is controlled by Firebase Security Rules and Firebase Authentication. UNPWNED uses public client configuration for bounded anonymous-access checks and reports confirmed exposure. Complete rule correctness requires Firebase-side tests and review.

Check your Firebase app now

Run free security scan

Last reviewed: 2026-04-07. Based on publicly available security research and UNPWNED scan telemetry.

Related Questions

Are Firebase Security Rules secure by default?Can Firebase apps be hacked?

More Firebase Security Questions

Are Firebase Security Rules secure by default?How do I secure Firestore properly?How do Firebase Storage Security Rules work?Can Firebase apps be hacked?How secure is Firebase Authentication?How can I test Firebase Security Rules?