Firebase - What is the API Key

Question

In Firebase, when we sign up , it gives us an API key for each firebase Url. But where is it used in a consuming application? The fireBase API does not provide any means to supply API Key.

Security : What prevents anyone to go ahead and write any object to the given firebase Url? How is the authorization managed?

Solution 1

You can generate your api key at https://console.developers.google.com/apis/credentials?project=[YOUR-PROJECT]

Replace [YOUR-PROJECT] with your proyect ID.

Find more information at https://support.google.com/cloud/answer/6158862

regards.

Solution 2

updated the links to the new Firebase website

Your question is very timely, as Firebase just announced its full security suite a few days ago.

There's a nice intro screencast and docs here: https://firebase.google.com/docs/database/security/

The "API Key" is the old name for a Firebase Secret. This is used to generate Authentication Tokens to prove to Firebase who users are. You can see docs on authentication here: https://firebase.google.com/docs/auth/

Solution 3

Follow these steps:

1. Login to Firebase Console
2. Select your project
3. On the top left corner, you'll find Settings icon, click on Project Settings

4. For Web API key, you can find in General Tab

5. For Server Key, you can find under Cloud Messaging Tab

Comments

[Kato]

For people looking for the 3.x and above API Key to insert in your initializeApp() config, see docs here: firebase.google.com/docs/web/setup#add_firebase_to_your_app

[deepelement]

Good response at stackoverflow.com/a/37484053/1195652 on why the key isn't a security risk

[Kinka]

I did as the document says, but trapped by the error FirebaseAuthClient is not defined as I'm trying to use new FirebaseAuthClient(). So, what's wrong?

[Kinka]

OK, I know... I need to add the Firebase Simple Login JavaScript include, but it doesn't tell us where the code exists. However, I found it at github.com/firebase/firetube...

[Jason Pudzianowski]

^ Is the correct answer. You need to include <script type="text/javascript" src="cdn.firebase.com/v0/firebase-auth-client.js"></…>

[abbood]

what does this gotta do with firebase?

[Eliut Islas]

Everything. Firebase is a Google product.