Skip to main content
Firebase Security Guide
Q&AFirebase

Is the Firebase API key a secret?

The Firebase API key is not a secret and is designed to be included in client-side code. It serves as a project identifier rather than an authentication credential, similar to a public project ID. The API key alone cannot read or write data since that access is controlled by Firebase Security Rules and Firebase Authentication. However, if security rules are misconfigured, anyone with the API key can access your data because it is publicly visible in your JavaScript bundle. UNPWNED verifies that your Firebase project has proper security rules in place so that the public API key cannot be exploited for unauthorized data access.

Check your Firebase app now

Run free security scan

Last reviewed: 2026-04-07. Based on publicly available security research and UNPWNED scan telemetry.

Related Questions

Are Firebase Security Rules secure by default?Can Firebase apps be hacked?

More Firebase Security Questions

Are Firebase Security Rules secure by default?How do I secure Firestore properly?How do Firebase Storage Security Rules work?Can Firebase apps be hacked?How secure is Firebase Authentication?How can I test Firebase Security Rules?