Is it safe to expose your Firebase API key?
Yes, the Firebase apiKey in your web config is meant to be public. It identifies your project; it doesn't grant access on its own. Every Firebase web app ships it to the browser.
What actually protects your data
- Firestore and Realtime Database Security Rules. Rules like
allow read, write: if true;(common in tutorials and test mode) let anyone read and change everything. - Storage rules, for uploaded files.
- App Check, which helps make sure requests come from your real app.
What to check before launch
- Open your Security Rules and make sure no collection with user data allows open reads or writes.
- Make sure test-mode rules are gone; they expire, but some people extend them.
- In Google Cloud Console, restrict the browser key to your domains as an extra layer.
The things you should never ship to the browser are service account JSON files and Admin SDK credentials. Those are full admin access.