In Firebase world API keys are for identification, not authorisation. https://firebase.google.com/docs/projects/api-keys https://firebase.google.com/docs/proje

In Firebase world API keys are for identification, not authorisation. https://firebase.google.com/docs/projects/api-keys https://firebase.google.com/docs/projects/api-keys Public by design: API keys for Firebase services only identify your Firebase project and app to those services. Authorization is handled through Google Cloud IAM permissions, Firebase Security Rules, and Firebase App Check.