title: Unrestricted Firebase key can be used for other paid Google APIs
body: <p><a href="https://firebase.google.com/docs/projects/api-keys" rel="nofollow noreferrer">Firebase docs</a> suggest firebase auto-created keys should not be restricted and unlike other sercet keys can happily appear in website's source:</p>
  <blockquote>
  <p>Unlike how API keys are typically used, API keys for Firebase services are not used to control access to backend resources; that can only be done with Firebase Security Rules. Usually, you need to fastidiously guard API keys (for example, by using a vault service or setting the keys as environment variables); however, API keys for Firebase services are ok to include in code or checked-in config files.</p>
  </blockquote>
  <blockquote>
  <p>The API keys auto-created by Firebase, by default, have no restrictions.</p>
  </blockquote>
  <blockquote>
  <p>Secure your database and Cloud Storage data by using Firebase Security Rules, not by restricting and/or obscuring your API keys.</p>
  </blockquote>
  <p>However, it seems that when we include our firebase key in our source code, it can be used by a malicious attacker to call paid Google services, such as <a href="https://developers.google.com/custom-search/v1/overview" rel="nofollow noreferrer">Custom Search APIs</a> which costs $5/5000 queries, thus draining the Google console balance of a poor unsuspecting victim.</p>
  <p>Also, it seems adding restrictions to Firebase keys is not working - either preventing the key from working or triggering a creation of a new auto-generated key instead (see <a href="https://stackoverflow.com/questions/42319008/firebase-google-api-key-restriction-doesnt-work">here</a>, <a href="https://stackoverflow.com/questions/59704954/cant-login-to-firebase-after-i-added-key-restriction">here</a>, <a href="https://stackoverflow.com/questions/65744031/firebase-api-key-restrictions-issue">here</a>)</p>
  <p>So should we somehow restrict the api-key,
  hide the key from the website's source
  or something else?</p>