This morning I got the dreadful Google email: "Immediate action required: Suspension of your Google Cloud Platform / API project " due to "abusive activity consistent with hijacked resources".

Google completely cut me out of the GCP platform that manages my LIVE app. This is not a hobby project, but my livelihood. The email redirected me to my GCP page where I could send an appeal, and do... nothing else. I had no access to anything else so it was difficult even to understand what happened: every action brings me back to "Send an Appeal". Which, of course, I did as fast as possible.

After some digging (apparently the biling page was NOT restricted! Not easy to find) An API key of mine leaked, someone found it and used it to generate images. Two dollars ($2!) of unauthorized spend. My mistake, no excuses.

The part I genuinely cannot solve is this. The notice asks me to revoke the compromised credentials, but I can't do that: `Permission denied: Consumer 'projects/{project_name}' has been suspended.`

I did what I could from outside: deleted the key through AI Studio, rotated everything else, ran a forensic check of my server and confirmed it was only the key, no host compromise. I would gladly pay for support to talk to someone. But guess what, Standard and Enhanced both need an Organization resource, which a personal account does not have, and billing chat is not available to me either (back to "send an appeal")

For a solo developer this is the difference between a bad day and losing the business. It seems absurd a business can get destroyed over a oversight and $2. The reports I read online are disheartening: people wait 1-2 weeks for a response, and then the back and forth is endless. I am going to lose the business I have worked for the past 4 years, and all for $2 and a stupid oversight.

Can anyone help? Has anyone here had a suspension for a stolen API key actually reversed, and how long did it take? And is there any way to reach a human without an Organization resource?

Project is 902887279759, appeal ticket YJ65HT5PKS5FDASU2C73BWIJ5Q, filed 21 Jul 2026. Any help is immensely appreciated

EDIT: Less than 24 hours later, google has re-instated my account! WOOOOHO!

Any one else heavily disappointed? ☹️

Apparently they're going to release more information, about migration, this September. Until then, I guess we all just sweat it out, wondering how to replace this functionality.

Currently running the firebase algolia extension to allow for complex querying for a photo organization app used internally at my company. With the deprecation of Firebase extensions coming up, wondering what solutions are out there for multi-faceted queries. As I understand it, I would essentially need to make an index for every possible combination of nested facets in order to do so natively with firestore queries and that would put me well over the cap on indexes.

Is there a sustainable manual process for connecting firestore data to algolia? My concern is that after the full deprecation of firebase extensions next year, updates will no longer be possible to the extension's code so any potential breaking changes to algolia's api would become unfixable with the extension's setup.

Relevant firebase update: https://firebase.google.com/docs/extensions/faq-and-troubleshooting

I run a poker tournament app on Firebase. The blind clock advances levels on a schedule, and I first built it the obvious way: a tick loop counting down to the next level. It worked perfectly in testing.

In the wild, hosts would leave the tournament running with the app backgrounded, or on a laptop that went to sleep, and the timer would fall behind. Browsers and mobile OSes both throttle timers aggressively when your app isn't foregrounded, so "one second" quietly stops being one second.

The fix was to treat the client timer as display only, never a source of truth. The next level-change time is written server-side. The client computes remaining time from that server timestamp on each render, and an event-driven monitor fires the actual transition, so even if the tick loop is throttled, the level still changes on time once the app comes back. Reading the server's clock offset instead of trusting Date.now() on the device was the piece I wish I'd started with.

If you have any countdown that matters (auctions, quizzes, anything scheduled), assume the client clock will be paused or slowed at the worst possible moment, and anchor it to a server timestamp.

Had firebase notifications working fine in my app back in the day using the old tokens, but now that they've deprecated the old apis and recommend using the FID instead of a token I'm unable to get anything working. Every FID I try to use to send a notification the api responds with NotRegistered. I've updated my native code to use Installations.installations().installationID() instead of Messaging.messaging().token as mentioned in these docs https://firebase.google.com/docs/projects/manage-installations#fid-iid, but still no luck.

Anyone dealt with this before? Any help is much appreciated.

I am trying to make a simple note app. The user can do whatever they want to the descendants of his userID document but for his userID document he can only read it.

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {

    match /dummyUsers/{userID}{
    allow get: if request.auth != null && request.auth.token.email_verified && request.auth.uid == userID
    }
    // Allow read write operations if user is accessing his storage
    match /dummyUsers/{userID}/{documents=**}{
      allow read, write: if request.auth != null && request.auth.token.email_verified && request.auth.uid == userID 
    }
  }
}

These are the rules. They should work but for some reason the second rule also applies to access at /dummyUsers/userID. So if I try to delete my userID document I am able to do so.

Of note, I am using the rules playground to test the rules.

What am I missing? does the recursive wildcard match empty paths as well?

So unlike before when I used to just go here into the firebase studio and go to my project and then click on move now option and then click on the zip and download option to download the entire thing in my laptop. But now if I do the same process it takes me to the Google cloud marketplace. What's wrong? And how can I do it for free like before?

My firebase rules are 5000+ lines long, but under 200KB in size, I keep getting errors as to why it won't publish

Error saving rules –An unknown error occurred

I have passed my rules through gemini/chatgpt/claude

Still not the wiser, is there a limit to the lines I can have, or another way to figure out my issue

Need some genuine advice guys.

I'm a founder of a very early stage startup. Few months back somehow our Firebase/GCP service account got compromised and someone started spinning up Compute Engine VMs continuously from an unknown IP. Before we noticed and disabled billing, the bill reached $8.8K.

We immediately rotated all keys, secured everything, investigated, even filed a cyber crime complaint. We still couldn't figure out how the attacker got the credentials. Only thing we suspect is our GitHub repo was public and we had the service account stored as a GitHub Actions secret (never committed in the repo and was encrypted as github secret).

Google Billing Support escalated the case but finally denied the waiver.

The painful part is... after this happened, Google approved us for $75k Google for Startups credits, but we can't even use those credits because of the outstanding bill.

Now I've received a debt recovery notice saying I have 10 working days before it gets sent to a recovery agency.

Honestly we don't have that kind of money. We're barely surviving as a startup.

Has anyone here actually managed to get a denied billing case reopened? Or got help from someone inside Google (Startups team, account manager, Developer Relations, anyone)?

I'm running out of time. Any advice, contacts or similar experiences would really help 🙏

I'm working on an app that will let people with different kinds of accounts track their analytics in one platform. Trouble is, I don't actually have a firebase analytics account to test with. Would anyone mind testing the connection and giving feedback on the data, and letting me know of any bugs? it's completely free. apptracker.tech

I have been using Google Firebase for years. From last-day onwards, whevenr I try to enter inside the firebase website, it always asks me this captcha.

Is anyone else facing the same issue? Is it becuase any issues in my network or any chances of suspecious activities in my account, please?

https://firebase.google.com/docs/remote-config/pricing

Starting September 1st 2026, Remote Config will offer a flexible pricing structure designed to accommodate projects of all sizes, featuring both a no-cost plan and a scalable pay-as-you-go tier based on your daily usage.

Same as title

I have installed this extension in a lot of projects and every single time i end up getting failed attempts due to nam5 and nam7 thing that i could never understand. But this combination finally worked. Saving this for the world. Don't use my email id :/

I made a MERN-based project and hosted it on Render. To store images like user icons and posts, I was using Firebase in 2023.

Recently, I found that my images aren't appearing in the program due to a policy change from Firebase. Is there any way I can get my images back?

Can anyone help me fix this?

Unable to process request due to missing initial state. This may happen if browser sessionStorage is inaccessible or accidentally cleared. Some specific scenarios are - 1) Using IDP-Initiated SAML SSO. 2) Using signInWithRedirect in a storage-partitioned browser environment.

I'm using GitHub as the auth provider via firebase for my website, it works fine on my laptop but displays the above text when i try to log in from my phone.

https://github.com/Shridharrrr/ossify - here's the repo link.

Hey, everyone

I'd like to share here a small cli tool I made that will help you with managing tokens while in development. It allows you to login once to your user and then fetch a valid token via CLI for curl requests, or via HTTP for Postman or other HTTP clients.

Everything is stored locally. No metrics, analytics or anything is or will ever be fetched.

https://github.com/andrespd99/fireauth

Building a Flutter app with Firebase Auth. Can't test on Android emulator so using Flutter Web on Chrome. Email auth works fine but Google Sign-In fails on localhost.

Tried both signInWithPopup and signInWithRedirect — both fail with:

Code

Already tried:

Added Web OAuth client ID meta tag to index.html

Created dedicated Web OAuth 2.0 client in Google Cloud Console

Added authorized JavaScript origins and redirect URIs

Allowed popups for localhost in Chrome

Switched from popup to redirect flow

Nothing works. Seems Chrome is blocking Firebase's cross-origin auth frame specifically on localhost. Google Sign-In works fine on Android/iOS natively.

Has anyone solved this for local Flutter Web development?

Hi folks,

I'm a network/telephony engineer by trade so somewhat of a novice when it comes to development, Firebase and Google Cloud Platform, so apologies if I'm asking any stupid questions.

I've been using Firebase Realtime Database to perform lookups on an imported JSON file with about 100k records - so far this has been working really well and I'm not expecting a large number of lookups, at the very most 130 within a single day, with most days expected to be around 40. The data will change very infrequently - a couple times per year.

The lookups are performed in Cisco Webex Contact Center within an IVR flow - currently, I am using the Email/Password sign in provider, and sending a HTTPS POST including my username and password to retrieve a token code. I then send a HTTPS GET with the token code in the auth parameter to retrieve the filtered data.

However, Webex Contact Center supports automatic oAuth 2.0 token management via integration connectors which I think is a much more elegant/complete solution than POSTING an email/password from within the flow. I've previously set this up with Entra ID to access the Microsoft Graph API, which worked really well, but lists/file reading didn't scale well above a few thousand records, which is why I switched to Google Cloud Platform and a Firebase Realtime Database.

I've been tinkering with Google's Identity and Access Management module and Service Accounts to try and get this setup, however for the life of me I cannot get this working - it either rejects the credentials outright, or it sets up the connector and then just hangs in the flow. I guess my questions are:

A) Is it possible to setup oAuth 2.0 using "Client Credentials - Client Secret" with Firebase Realtime Database? The required fields in Cisco Webex Contact Center are Resource Domain (URL used to access the API), Client ID, Client Secret, Token URL and Scope. Other authentication options are "Client Credentials - Password Grant" and "Basic Authentication" which ask for a username and password (tried these, also couldn't get them working).

B) If so, does anyone have a guide I could follow to set this up, or could provide some high-level instructions on where to map those required fields above? I'd normally link the guides that I've already followed, but I've tried pretty much everything I could find in the Google Cloud/Firebase documentation (and elsewhere).

C) If it's not possible, are there any caveats with the Email/Password sign in method that I should know about? The username/password is masked, and stored in a secure location that only admins have access to, but eventually this database will be storing PII data, so obviously I want to make sure this is as secure as possible.

If you've made it this far, thanks for reading, and again apologies if I've asked any stupid questions!

Hello everyone,

We are experiencing a data attribution anomaly with the automatically collected first_open event in Firebase Analytics / GA4 that we cannot explain through our codebase or app behavior.

Firebase Support reviewed the case but referred us to the Google Analytics team because the issue concerns Analytics reporting and user attribution.

Technical setup

• Capacitor hybrid mobile app
• Vue 3 and Ionic
• u/capacitor-firebase/analytics v7.3.1
• Available on both Google Play and the Apple App Store

Observed issue in production

For one recent reporting period, the first_open event showed:

• Event count: 25
• Total users: 1
• Countries represented: 7
• United States, United Kingdom, Ukraine, Australia, Canada, Lebanon, and Ireland

For a broader reporting period:

• Event count: 96
• Total users: 9
• Event count per active user: approximately 11

It is difficult to understand how first_open events from installations across seven different countries could be attributed to only one user.

The ratio of approximately 11 first_open events per user also appears implausible for normal app behavior.

Expected behavior

Our development and emulator testing produced the expected result:

• 4 fresh installations
• 4 events
• 4 users
• 1 event per user

Firebase DebugView also looks correct during testing. The discrepancy appears only in aggregated production reports.

What we have verified

• We do not call resetAnalyticsData().
• We do not clear native app storage, SharedPreferences, or internal storage during logout.
• Logout only removes authentication tokens from web local storage.
• We do not manually trigger the first_open event.
• setUserId() is called only after first_open should already have fired.
• The issue does not reproduce in development or emulator testing.

Additional context

Firebase Support said they did not detect a specific anomaly for first_open.

However, they identified a separate anomaly involving an unexpected increase in screen_view events on the main app screen, driven primarily by activity from the United States and Australia.

We do not know whether this is related, but some of the same countries appear in the unusual first_open reporting.

Question

How can automatically collected first_open events from geographically distinct devices or installations be attributed to only one or a very small number of users in GA4?

Any guidance from someone who has encountered similar Firebase Analytics behavior would be greatly appreciated.

​

**Background:**

I'm building a Flutter app (OrbiTask) that targets Android, iOS, and Web from a single codebase. I'm developing on Windows, testing the web version on Chrome via `flutter run -d chrome`. I can't use an Android emulator currently due to RAM limitations, so web is my primary testing environment.

**The Setup:**

- Flutter + Firebase Auth + `google_sign_in: ^6.2.1`

- Firebase project with Android, iOS, and Web apps registered

- Authentication enabled in Firebase Console with Google as a sign-in provider

- `firebase_core`, `firebase_auth` packages installed

**What I tried and what happened:**

**Step 1 — Initial attempt:**

Tapped Google Sign-In button. Got this error:

```

Google Sign-In error: Assertion failed:

appClientId != null

"ClientID not set. Either set it on a <meta name="google-signin-client_id"> tag"

```

The `google_sign_in_web` package requires a client ID set in `web/index.html`.

**Step 2 — Added meta tag:**

Added to `web/index.html`:

```html

<meta name="google-signin-client_id" content="CLIENT_ID.apps.googleusercontent.com" />

```

Used the Web client ID from Firebase Console → Authentication → Sign-in method → Google → Web SDK configuration. Same ID kept showing — turns out there was only one OAuth client ID in the project shared across platforms.

**Step 3 — Created a dedicated Web OAuth client ID:**

Went to Google Cloud Console → APIs & Services → Credentials → Create Credentials → OAuth Client ID → Web application. Added authorized JavaScript origins:

- `http://localhost`

- `http://localhost:5000`

Added the new client ID to the meta tag. GSI logger started initializing:

```

[GSI_LOGGER]: FedCM mode supported.

[GSI_LOGGER-TOKEN_CLIENT]: Instantiated.

```

Progress — but sign-in still didn't complete.

**Step 4 — Popup blocked:**

Discovered Chrome was blocking popups for localhost. Allowed popups in Chrome site settings. Sign-in started loading but then stopped with:

```

Unsafe attempt to load URL https://orbitask-d1669.firebaseapp.com/__/auth/handler?...

from frame with URL chrome-error://chromewebdata/.

Domains, protocols and ports must match.

```

**Step 5 — Added Firebase domain to authorized origins:**

In Google Cloud Console OAuth client added:

- `https://orbitask-d1669.firebaseapp.com\` to JavaScript origins

- `https://orbitask-d1669.firebaseapp.com/__/auth/handler\` to redirect URIs

Same error persisted.

**Step 6 — Switched from popup to redirect flow:**

Changed web auth flow from `signInWithPopup` to `signInWithRedirect` + `getRedirectResult`. Also added redirect result handler in `main.dart`. Same error appeared but with `authType=signInViaRedirect` instead of `signInViaPopup` — same Chrome block regardless of flow.

**Current status:**

Both popup and redirect flows fail on localhost with the same Chrome cross-origin frame error. Email auth works perfectly. Google Sign-In works on Android/iOS natively. The issue appears to be Chrome blocking Firebase's auth handler frame specifically on localhost regardless of authorized domains or popup settings.

**Questions:**

1. Is there a way to make Firebase Google Auth work on Flutter Web via localhost without deploying?

2. Is there a Chrome flag or setting that bypasses this cross-origin frame restriction for development?

3. Has anyone successfully tested Flutter Web + Firebase Google Sign-In on localhost in 2025/2026?

**Environment:**

- Flutter stable channel

- Chrome on Linux (Ubuntu)

- `firebase_auth: ^5.3.0`

- `google_sign_in: ^6.2.1`

- Testing on `http://localhost:[port]`

Hey everyone, been banging my head against this for a while and can't find

anyone with the same issue online.

**The problem:** Every time I try to set a custom action URL in

Authentication > Templates, I get this error:

EMAIL_TEMPLATE_UPDATE_NOT_ALLOWED (400 INVALID_ARGUMENT)

Tried it from the Firebase Console UI and also via direct API call

(PATCH to identitytoolkit.googleapis.com/v2/projects/{id}/config) —

same error both ways.

**What I already ruled out:**

- Domain IS in the authorized domains list

- Custom SMTP is disabled

- No multi-tenancy

- Custom sender domain ([[email protected]](mailto:[email protected])) works fine

- Not a permissions issue — the API returns 400 not 403

- Tried multiple URL formats and subdomains

**Context:**

- Project uses Firebase Auth **with Identity Platform** enabled

- Emails send correctly from the custom domain

- But links in emails still go to firebaseapp.com instead of my domain

Has anyone run into this? Is it a known bug with Identity Platform projects?

For people who have worked with both, where does Firestore make the most sense, and when does MongoDB Atlas become the better option?

Firestore has obvious advantages for Firebase-native apps, real-time updates, and low operational overhead. MongoDB seems stronger when applications need more flexible querying, broader portability, or data models that do not fit as naturally into Firestore’s constraints.

I’d be especially interested in production experience around:

• Querying and schema design
• Pricing as usage grows
• Scaling and performance
• Developer experience
• Long-term flexibility

Was tired of rewriting the same Firebase boilerplate every time I started a side project - auth state handling, protected views, XSS-safe rendering, per-user database scoping. Packaged it up as a single HTML file: paste in your config, and you've got working email/password auth, Google sign-in, and a realtime database CRUD example, all wired up. No npm install, no bundler . just open the file. Also ships with proper Realtime Database security rules, since most free starter kits I found skip that part entirely and leave the database wide open. £5 (~$6.70) if anyone wants it - link in comments. Happy to answer questions about the setup or the architecture.

Hello,

I’m on Blaze plan with a mobile app that’s on the App Store. Every month, usage and billing has been telling me that I have a few cents in expenses, but I have not see a bill nor paid for this as far as I can tell. I went to Google cloud console billing reports, and it’s telling me I’ve saved 14 cents YTD. How have I saved money? Can someone explain how this works to me?

Thanks!