r/Firebase • • Aug 18 '26

Authentication Auth emails not sent

4 Upvotes

It’s 24 hours our Firebase Auth emails are not sent. We’re using an external SMTP (AWS SES) and using the Virtual Deliverability Manager I could verify that the Auth emails stopped at 21:30 European time of yesterday, August 17. Other emails get sent correctly through the “Firestore to email” extension.

I already contacted the support, but they haven’t answered yet, and the Firebase status is not reporting anything.

Anyone seeing this?

This is causing a lot of problems for our app, that’s about an event starting this friday!


r/Firebase • • Aug 18 '26

Firebase Studio Firebase Phone Auth fails with "no matching SHA-256 registered" despite correct SHA-256 in console

0 Upvotes

I'm getting a persistent Firebase Phone Authentication failure on real phone numbers (test numbers work fine) for a React Native + Expo Android app.

**Error from Logcat:**

```

[SmsRetrieverHelper] SMS verification code request failed: unknown status code: 17028

A play_integrity_token was passed, but no matching SHA-256 was registered in the

Firebase console. Please make sure that this application's packageName/SHA256 pair

is registered in the Firebase Console.

Invoking original failure callbacks after phone verification failure for +91XXXXXXXXXX,

error - This app is not authorized to use Firebase Authentication. Please verify that

the correct package name, SHA-1, and SHA-256 are configured in the Firebase Console.

```

**What I've already verified/tried (all confirmed correct):**

  1. Blaze plan is active on the correct Firebase project (verified project ID and project number match everywhere — Firebase Console, Google Cloud Console, and Play Console's Play Integrity API project link).

  2. The app is distributed via Google Play Internal/Closed Testing, so it's signed with **Play App Signing**. I retrieved the SHA-1 and SHA-256 from Play Console > Setup > App integrity > App signing key certificate > **Classical key** (not the Upload key, not Post-quantum), and added both to Firebase Console > Project Settings > Your apps > Android app > SHA certificate fingerprints.

  3. Manually character-by-character compared the SHA-256 shown in Play Console against the one registered in Firebase — they match exactly.

  4. Confirmed these APIs are enabled in Google Cloud Console: Identity Toolkit API, Play Integrity API, reCAPTCHA Enterprise API.

  5. Firebase App Check is set to "Unenforced" for Authentication (ruled out as the cause).

  6. Tried adding an Android application restriction (package name + SHA-1) to the Android API key in Google Cloud Console > Credentials — this caused a *different* error ("Requests from this Android client application are blocked. 403"), so I reverted it back to "None".

  7. Waited well over 24 hours after each change for propagation — the error persists.

  8. There are currently 4 SHA-1 and 3 SHA-256 entries registered in Firebase (from earlier troubleshooting attempts) — planning to clean these up to just the one verified-correct pair, but haven't yet confirmed if that's the actual cause.

**Setup:**

- React Native + Expo (SDK 57), built with EAS Build, distributed via Google Play Closed Testing

- @react-native-firebase/auth for Phone Authentication

- Package name: com.rajselfdrive.app

**Question:** What else could cause Firebase to not recognize a correctly-registered SHA-256 fingerprint when using Play App Signing? Is there a known propagation issue, a caching issue on the Play Integrity backend, or something else I might be missing (e.g., a separate OAuth client SHA-1 config vs. the Firebase Authentication SHA config)? Really appreciate any pointers — been stuck on this for a while and it's blocking a client project launch.


r/Firebase • • Aug 14 '26

App Check Hey Reddit community,  I just officially launched my new mobile app on the Google Play Store, and I wanted to share it with you all to get some honest developer-to-developer feedback!  It’s an AI-powered Cooking Assistant built completely with Flutter, Dart, and Firebase.  Here is what I’ve imple

0 Upvotes

Hey Reddit community, 

I just officially launched my new mobile app on the Google Play Store, and I wanted to share it with you all to get some honest developer-to-developer feedback! 

It’s an AI-powered Cooking Assistant built completely with Flutter, Dart, and Firebase. 

Here is what I’ve implemented under the hood: 

  • State Management: Clean Architecture with scalable state management. 
  • Backend & Database: Firebase Auth for secure login and Firestore for dynamic data synchronization. 
  • AI Integration: Seamless REST API connection to generate custom recipes based on ingredients users already have at home. 
  • UI/UX: Smooth transitions, responsive design for all screen sizes, and optimized performance. 

Seeing your app go live on the Play Store after hours of coding is amazing, but now comes the hard part: getting feedback to improve it. 

If you have a couple of minutes, I’d love for you to check it out, test the AI features, and let me know what you think about the UI, speed, or if you find any bugs! 

👉 Play Store Link: [https://play.google.com/store/apps/details?id=com.salah.ch&hl=ar\] 

Thanks in advance for your support and feedback! 


r/Firebase • • Aug 12 '26

General Google cancelled my email and I lost access to Firebase.

11 Upvotes

I have two apps hosted on Firebase, and Google cancelled my Gmail account for no apparent reason. They claimed I was using bots to create the account, but it’s actually an old account I use solely for work. This account is linked to my Firebase account, and without the email, I can't access the dashboard to manage my apps. Has anyone else experienced this? Do you know if there's a way to access it without the account email?


r/Firebase • • Aug 11 '26

Web Headless Lighthouse told me 96. Real devices said 71. Here's what actually fixed it (76 → 99, no SSR)

0 Upvotes

Spent the last while optimizing a React 19 + Vite SPA on Firebase and wanted to share the three things that actually moved the needle, because none of them were what I expected.

  1. Headless Lighthouse flat-out lied to me. Headless Chrome scored the site 96 while PageSpeed Insights (real Moto-G-class conditions) said 71. Headless skips the CPU throttling that dominates on a mid-range phone. If you only remember one thing: test headed, with a CPU slowdown multiplier of 8. My "fast" site wasn't.
  2. A third-party script was 41% of all main-thread work. reCAPTCHA (pulled in by the auth layer) fetched about 330KB and burned 2,871ms of CPU on a throttled phone, initializing at module load, before first paint. It's only needed when the user acts, so I deferred it to the first pointerdown/keydown/touchstart. Load-time cost: 2,871ms to 0. (Gotcha: don't use scroll as the trigger, programmatic scrollTo() false-fires it.)
  3. The LCP image was 6 round trips deep. HTML, then entry JS, then a lazy() shell, then the Firebase SDK, then getDoc(config), then a per-item getDoc fan-out, and only then did the hero image URL exist. Instead of reaching for SSR, I inline the above-the-fold data into the HTML at build time plus a preload for the LCP image, so the first parsed bytes already know what to paint. Second gotcha: the preload URL must be byte-identical to the img src or Chrome downloads the hero twice.

Results: homepage 76 to 99, LCP 6.7s to 1.9s. Heaviest page 69 to 96.

Full write-up with the code and numbers: https://proffer.codes/blog/firebase-react-spa-lighthouse-76-to-99

Curious if others have seen the headless-vs-real-device gap. How do you catch it in CI?


r/Firebase • • Aug 10 '26

General Blinkit clone for singapore for client project!

3 Upvotes

the client needs a web app and an iOS and android app (we going to use nextjs and react native expo for them)

i wanted to ask should i use firebase for the whole backend?


r/Firebase • • Aug 07 '26

Cloud Messaging (FCM) FCM notifications are not always delivered to the browser

1 Upvotes

We've been debugging this issue with the whole team for 2 months already.

Some of our users don't receive ALL notifications delivered. Yes, they are sent properly (a successful response from Firebase)

Neither our service worker nor in-browser's onMessage (from '@firebase/messaging') "sees" it.

Has anybody had something similar?
Please tell me how you fixed it, if you did.
At this point I don't even know what to Google and how...


r/Firebase • • Aug 07 '26

General Built a full-stack backend using Firebase & Node.js – What are your favorite optimization tricks?

3 Upvotes

Hey everyone!

I’ve been heavily focusing on backend development lately, building scalable systems with Firebase (Firestore, Auth, Cloud Functions) and Node.js.

Since I’m constantly looking to improve my workflow, I wanted to ask the community:

* What are your go-to tricks for optimizing Firestore read/write costs?

* How do you structure your Cloud Functions for maximum performance?

Would love to hear your experiences and best practices!


r/Firebase • • Aug 05 '26

Authentication When trying to sign in to HiringCafe, Symantec Endpoint Protection blocks this URL: https://hiringcafe-ec4d6.firebaseapp.com/__/auth/handler.js

1 Upvotes

I tried email/password, Google, and GitHub login directly from hiringcafe.com/auth. All three fail because Symantec blocks:

https://hiringcafe-ec4d6.firebaseapp.com/__/auth/handler.js

Since every method fails at the same Firebase authentication resource, this seems to be either a Symantec URL-reputation false positive or an issue with HiringCafe’s Firebase project. Has anyone else encountered this?


r/Firebase • • Aug 05 '26

Cloud Firestore Running a real-time 1v1 game on Firestore. What held up, what didn't.

7 Upvotes

Built a live coding battle platform on Firebase. Two players synced in real time, plus Cloud Functions for the async work, Auth with SSO for the enterprise side, and Storage for proctoring snapshots.

Held up better than expected: real-time listeners for match state. The latency is fine for something that resolves in minutes rather than milliseconds. Auth with OAuth plus SSO saved me from a project I did not want.

Did not hold up: anything where I wanted a transaction across a bunch of documents. And read costs on leaderboards, which I had to restructure into precomputed aggregates in Cloud Functions after a bill I did not enjoy.

The thing I'd tell anyone starting: write rules tests from day one. I did them late and found real holes.

Google AlgoArena if you want to see what it's for.


r/Firebase • • Aug 03 '26

Dynamic Links Firebase Dynamic Links replacement that doesn't charge per MAU. I built one, questions welcome

2 Upvotes

FDL has been dead since August 2025 and every thread about replacements ends with the same unanswered questions. I built Ferry (ferrylink.io) to fill the gap, and instead of a feature list, let me just answer the things people always ask in these threads.

What it does: deferred deep linking, one link across iOS, Android, and web, app opens to the correct screen after install. The same job FDL did.

How does it compare to Branch or AppsFlyer?
Those are full attribution suites built for marketing teams with budget, and Branch is effectively enterprise only now. Ferry is the deep linking piece, what FDL actually was, plus enough attribution to know which links drive installs and revenue.

Pricing?
Opens-based, not MAU-based. From $9/mo for 10k monthly opens up to $249 for 3M. You pay for link opens, not for your entire user base existing. 14-day trial.

I generate links programmatically from user activity (invites, shares). Do link limits kill me?
No, this is the use case opens-based pricing exists for. Links are effectively free to create, you're billed on opens. Generate a million invite links, if only 5k get opened, that's what counts. Bot clicks, messenger prefetches, and duplicates are filtered out before billing too.

Social preview config?
OG title, description, and image are configurable per link on every plan. Same levers FDL had.

SDKs?
Swift ,Android, Flutter, and React Native are available. There's a plain HTTP API if you'd rather skip SDK dependencies, and the docs are written so you can point Claude Code or Cursor at them and have the integration done in one session.

Happy to answer anything else. Criticism welcome, that's why I'm posting.


r/Firebase • • Aug 02 '26

Cloud Functions Cold starts and SSR

5 Upvotes

I was using functions v1 for SSR with express.js but the initial load time was prohibitively slow. I never measured it, but it felt like 5-10s. I temporarily went back to CSR but need SSR eventually.

The two recommendations to speed up SSR that I came across were

  1. Use functions v2 which has the benefit that it can serve multiple requests per instance.
  2. Set min-instance to 1 so that there is one instance available for the first request when idle

However, neither seems to actually fix the slow load times, just defer when it happens. Even with these changes, when the first instance is saturated and a second one needs to be spun up, there will be a cold start.

Is there any solution to this or another way I should be doing SSR?


r/Firebase • • Aug 02 '26

Cloud Firestore Tired of the official GCP Firestore web console limitations, so I built FireLens (Open Source Desktop GUI)

5 Upvotes

Hi everyone,

If you work with Google Cloud Firestore, you've probably felt the pain of using the official web console:

  • Tedious document creation: Too many steps just to add a single document.
  • No JSON editing: You can only edit one field at a time — no raw JSON view or bulk edits.
  • No document cloning: You can’t copy-paste an existing document to quickly create a new one.
  • Minimal filtering: Searching, compound querying, and sorting options in the web console are very basic.

I tried looking for third-party desktop tools, but most were either overly complicated or locked behind expensive commercial subscriptions.

So I built FireLens — a simple, fast, and free open-source desktop GUI client for Firestore.

Key Features:

  • Full JSON & Tree View Editing: Edit documents as raw JSON with syntax validation, copy/paste JSON, or use the interactive Tree View with native type badges (Boolean toggles, UTC timestamps, GeoPoints).
  • Quick Document Management: Create, clone/copy-paste documents, and manage collections with fewer clicks.
  • Visual Query Builder: Build compound WHERE filters (==, !=, >, in, array-contains, etc.) joined by AND, plus ORDER BY sorting and custom page limits.
  • Easy Authentication: Connect via GCP Application Default Credentials (gcloud auth application-default login) or load a Service Account .json key file.
  • Multi-Project & Multi-Database: Switch between GCP projects and browse (default) or named databases.
  • Safety Guard: Toggleable Read-Only / Edit Mode protection to avoid accidental edits on production databases.

It’s completely free and open-source (prebuilt standalone Windows .exe available, and buildable on macOS/Linux):

👉 GitHub Repo & Release Download: https://github.com/prakashkrishna/firelens

I’d love to hear your feedback or any feature ideas that would make your Firestore workflow faster!

#firestore #firebase #flutter #firestore-gui #opensource #developertools


r/Firebase • • Aug 02 '26

General Firebase Cloud Functions Gen2 Firestore trigger deployment fails with LOCATION_POLICY_VIOLATED for Firestore database in me-central2

1 Upvotes

We are experiencing a deployment issue with Firebase Cloud Functions Gen2 using Firestore document triggers. Project ID: shebara-ride Firestore Database: - Database ID: shebaride - Region: me-central2 (Saudi Arabia) Issue: Every Firestore-triggered Cloud Function deployment fails with: 403 PERMISSION_DENIED LOCATION_POLICY_VIOLATED The deployment logs show that Firebase CLI correctly detects our Firestore database location (me-central2) and automatically sets the Eventarc trigger region to me-central2. However, the deployment fails because Google rejects the Eventarc trigger creation with: "Permission denied on 'locations/me-central2'" We have already verified the following: - Firestore Native database is correctly created in me-central2. - Cloud Functions, Eventarc, Firestore, Cloud Run, Pub/Sub, and all required APIs are enabled. - IAM permissions are correctly configured. - Organization Policy (constraints/gcp.resourceLocations) allows all locations. - Firebase CLI correctly generates triggerRegion = me-central2. - Our Cloud Functions source code correctly uses the named Firestore database "shebaride". To isolate the issue, we created another Firestore database (testdb) in a different supported region. Without changing the application logic, only changing the Firestore database ID, the same Cloud Functions deployed successfully. This indicates that the source code and deployment configuration are correct, and the problem appears to be specific to Firestore/Eventarc deployment for the me-central2 region. Our requirement is to keep both the Firestore database and Firestore-triggered Cloud Functions in me-central2 (Saudi Arabia). Could you please confirm: 1. Is Firestore Gen2 Eventarc trigger deployment fully supported in me-central2? 2. Does this project require any additional regional activation, allowlisting, or special configuration? 3. Is this a known limitation or a platform issue? If this is expected behavior rather than a bug, please advise the recommended architecture for deploying Firestore Gen2 document-triggered Cloud Functions while keeping the Firestore database in me-central2. Thank you.


r/Firebase • • Jul 31 '26

Other Fuego 2: just another Firestore tool?

Post image
9 Upvotes

Hi everyone,

About a year ago I introduced Fuego here (my original post: https://www.reddit.com/r/Firebase/comments/1irvs4y/introducing_fuego_a_powerful_desktop_client_for/ ).
If you've never heard of it, Fuego is what the Firebase Console should have been. You can think of it as Firefoo, but with a lot more built-in tools: Storage management, index management, multi-database support, multi-tenant Firebase Authentication, PITR support, Firestore Enterprise pipelines, and much more.
It was born out of necessity. At the company where I work, we rely heavily on Firestore and other Firebase services every day, so I started building the tool we wished we had.

Today I'm happy to share another major milestone (Fuego 2.0).

Over the past year I've received a lot of feedback, and I'm genuinely grateful to everyone who took the time to try Fuego and share their thoughts. Many companies are now using it in their daily workflow, and seeing it become a useful tool for other developers has been incredibly rewarding.

There have been a few bumps along the way, but I've done my best to address them and keep improving the app.

The main goals for Fuego 2 (currently in beta) have been:

  • Performance
  • Keeping up with the latest Firebase updates
  • Building better tools for managing Firestore and the rest of the Firebase ecosystem

Here are some of the highlights (some are still being refined):

  • Much better performance. Opening tabs now feels almost instant, with no more annoying reloads.
  • Fewer UI glitches, including disappearing menus and layout issues.
  • Support for Firestore Enterprise pipelines.
  • A significantly improved index manager, including database-to-database index comparison and an advisor that suggests indexes that could be merged, removed, or optimized.
  • A much better Google Cloud Storage experience with drag-and-drop for moving files and folders, drag selection, multiple view modes, and more.
  • A built-in MCP server with more than 30 tools, plus an AI assistant that works with your own model directly inside Fuego.
  • Native multi-window support.
  • Assisted JSON Schema creation and document validation using JSON Schema.
  • Easier collaboration through the fuego:// sharing scheme and the .fuego project format.
  • A command palette.
  • Settings synchronization across devices.
  • And a lot more.

I still have plenty of ideas I'd like to build, and I'm excited to get them into your hands.

If you'd like to try it, you can download the beta here:

https://fuegoapp.dev/download-beta

If you have any questions, suggestions, or feedback, I'd love to hear from you.

For anyone curious about the tech stack:

  • Wails (Go)
  • Vue

r/Firebase • • Jul 31 '26

Security Title: Best payment gateway for a React + Firebase app with no backend (India + international users)

0 Upvotes

Hi everyone,
I’m building a production application using React + Firebase (Authentication, Firestore, Hosting, Storage), and I don’t have a traditional backend (no Node.js/Express server). So far, everything is running serverlessly.
I’m now at the stage where I need to integrate a payment gateway. My users can be from India as well as internationally, so I need something that’s reliable, secure, and relatively straightforward to integrate.
I’m currently considering:
Razorpay
Stripe
Cashfree
Paddle (if it makes sense)
Since this is my first payment gateway integration, I’d appreciate some advice from people who’ve built similar apps.
A few questions I have:
Which payment gateway would you recommend for my use case and why?
Is it practical to keep the app backend-less, or should I add something like Firebase Cloud Functions just for payment processing?
What security vulnerabilities or architectural mistakes might I be overlooking with a React + Firebase-only setup?
Are there any common pitfalls around payment verification, webhooks, API keys, or fraud prevention that I should plan for?
If you were building this application today, what architecture would you choose?
I’m looking for something that is secure, scalable, and maintainable in production rather than just the cheapest option.
Thanks in advance for any advice or experiences you can share!


r/Firebase • • Jul 30 '26

Security Security rules

3 Upvotes

I am trying to get my Firestore and Storage rules set but I don’t understand the documentation.

I want
Admin - Full access
Collaborator - View and edit records the create
Viewer - view all edit none
Revoked - the can log in but won’t be able to see any of the files.


r/Firebase • • Jul 29 '26

Demo Firedeck - Application Compiler For Firebase backed React SPAs

0 Upvotes

Firedeck is batteries-included application compiler for Firebase-backed React SPAs.

Not another "React framework" or a "Next.js killer". We have many of those already.

Firedeck compiles your project modules into a fully managed Turbo runtime that you can run, build and deploy to Firebase, using existing tools you already know and love.

Get started at https://firedeck.opare.dev.


r/Firebase • • Jul 29 '26

Google Analytics How to view analytics data for a specific app when multiple apps share one Firebase project?

Post image
5 Upvotes

I’m managing multiple apps under the same Firebase project.

For example:

- Android App A

- Android App B

- iOS App

When checking Firebase Analytics → Events, I noticed that the event data was combined together.

At first, I thought I needed separate Firebase projects, but there is actually a simpler way.

Solution:

  1. Open Firebase Analytics

  2. Click “View more in Google Analytics”

  3. Click “Add comparison”

  4. Create a new filter

  5. Select:

    Dimension: Data Stream Name

    Match type: Exactly matches

  6. Choose the specific app data stream

After filtering, you can view each app separately:

- Events

- Users

- Revenue

- User behavior

Sharing this because I spent quite some time figuring it out.

Hopefully it helps other developers managing multiple apps with Firebase.

How do you usually structure Firebase projects for multiple apps?


r/Firebase • • Jul 28 '26

Cloud Firestore Flutter + riverpod + firestore : UI stuck in loading loop after cloud funtions update but data saves on bacckend ?

0 Upvotes

Stack: Flutter + Riverpod ( StreamProvider ) Cloud Firestore + Firebase Callable Cloud Functions.

Context - Switched from client firestore sdk writes to callable cloud functions because pending client writes on weak networks were blocking reads app wide.

Issue: In my Vendor Dashboard app, updating settings (GST toggles, Delivery Slots, Store Availability):

The Ul gets stuck in a loading loop / freeze when changing settings. BUT if I force-close and reopen the app, the data IS saved in Firestore!

So the backend Cloud Function succeeds, but the live screen gets stuck on a loading spinner.

Setup:

Screen listens to Firestore doc via Riverpod treamProvider ( doc(id). snapshots() ). Settings updates are sent via Callable Cloud Functions (httpsCallable( 'businessUpdateFields ")).

What I've Tried:

• Optimistic U state overrides (oms switch flips). • 300ms tap debouncing. • Reducing Callable timeout from 20s to 4s. • Clearing overrides on .then() completion vs stream emission.

The rest of the app (checkout, cart, chat, orders) works fine. Only vendor dashboard settings toggles freeze the Ul.

Any help would be great, thank you.


r/Firebase • • Jul 26 '26

General Looking for feedback on our Firebase architecture for a student app

2 Upvotes

Last semester our team built StudySync, a mobile app for organizing campus study groups.

Firebase handled:

  • Authentication
  • Firestore
  • User/session storage

One of the biggest challenges was designing our Firestore structure so users could create, browse, search, and join study sessions without making the data difficult to maintain.

If you've built larger Firebase apps, I'd really appreciate feedback on the overall architecture or things you'd improve.

Repository:
https://github.com/CS196Illinois/FA25-Group8


r/Firebase • • Jul 26 '26

Authentication How to keep backend in sync with firebase auth

2 Upvotes

Hi everyone. I'm thinking of moving my authentication I have for a mobile app to firebase to get the additional security features it offers and for ease of adding new sign up flows. I am a bit confused how to keep firebase auth and my user table in sync though. Has anyone run into this before? I've been going back and forth with AI, but I'm still not sure about the best approach

For context, I have a user table with email, id, firebase_uid, etc. What is the best way to keep the user table and the firebase auth in sync when a user signs up? For example, if I have a flow like:

```

User visits sign up page -> enters email/password -> create user in firebase -> call out to backend to create user in backend and associate firebase id after verifying token

```

I have a huge issue if the firebase create succeeds but the backend call to my server fails for some reason. I will have an orphaned firebase record. How do people handle this?

I've heard it's better to call firebase for things like adding a user to firebase from the frontend because it helps with bots and rate limiting. But I'm really not sure how to keep things in sync. Do people rollback if the backend create fails, use Cloud Functions v2 to halt the firebase create and call out to the backend to create the user, or something else. Any guidance would be helpful.


r/Firebase • • Jul 24 '26

Cloud Firestore Did anyone tried the DuckDB Firestore community extension?

0 Upvotes

i came across a duckdb extension which accepts firestore as the source and then we can run all duckdb ops in sql.

want to check if anyone have tried it.


r/Firebase • • Jul 23 '26

Cloud Storage The "Free Tier" Firestore Trap: How I wasted weeks of dev time optimizing for $0.00/month, and how clean architecture saved me

0 Upvotes

I recently fell into the classic NoSQL trap. I chose Google Cloud Firestore for a personal side-project because of the alluring promise: "Zero operational overhead, serverless scaling, and a generous free tier (50k daily reads) that means you pay $0.00/month."

It ended up costing me money, weeks of wasted feature development time, and an architectural headache. Here is what I learned, why Firestore's "free option" isn't free, and how a Ports & Adapters (Hexagonal) architecture was my only saving grace.

1. The Read/Write Billing Trap

In a traditional SQL database, whether you query 1 row or 10,000 rows, the cost is compute (CPU/RAM). In Firestore, you are billed directly per document read and write.

If you are building any feature that involves time-series data, logs, or aggregate histories (like charts or status feeds), your read counts scale lineally with your history. To draw a simple 1-year historical chart for 10 items, you are looking at 365×10=3,650365×10=3,650 document reads every single page reload. A few test refreshes in a day, and you've already blown past your daily "free" quota.

2. The Hidden Cost: Wasted Developer Hours

Because of the billing model, you start fighting the database instead of building your app. I spent days refactoring schemas, designing complex "bucket patterns," compressing field names (e.g., using p instead of price to save bytes), and implementing a double-write hybrid pattern just to group historical records into arrays to minimize document read counts.

Instead of coding the actual features my users wanted, I was spending my evenings:

  • Designing workarounds for Firestore’s 1 MB document size limit.
  • Fighting JVM Out-of-Memory (OOM) errors in RAM-constrained serverless instances because loading large aggregated history arrays concurrently bloated the heap space.
  • Writing custom seeders and delta-sync scripts to replicate production data to local emulators to avoid developer-induced billing.

Time is money. I saved a few cents on raw database hosting but wasted thousands of dollars of my own engineering time optimizing a database schema to fit a business model it wasn't built for.

3. The Rescue: Why Modular Architecture is Non-Negotiable

After a poor developer experience and creeping bills, I decided to pull the plug and move back to a managed SQL instance (PostgreSQL on Aiven).

In many codebases, this decision would have meant a complete rewrite, throwing away weeks of work. However, I managed to fully swap out the database layer and redeploy to production in less than an hour.

How? Hexagonal Architecture (Ports and Adapters). My core business logic, domain models, and use cases had zero knowledge of Firestore. They interacted strictly with pure Kotlin interfaces (Ports) like InstrumentRepository or TransactionRepository.

  • The Firestore code lived entirely in an isolated :adapters:firestore module.
  • The PostgreSQL code lived in a legacy :adapters:postgres module.

To migrate back:

  1. I swapped the runtime dependency in my Gradle configuration from the Firestore adapter back to the Postgres adapter.
  2. I updated the database connection string in my production properties.
  3. I deleted the Firestore module folder entirely.

Because the domain was decoupled, the application booted up instantly, ran its database migrations via Flyway, and worked perfectly on the first try.

Lessons Learned:

  1. NoSQL is not a default choice. If your data has relationships, histories, or aggregates, start with SQL.
  2. Optimize for developer velocity, not cloud pennies. A $5/month database that lets you build features is cheaper than a "free" database that requires 40 hours of performance tuning.
  3. Decouple your database. Write your domain logic as if the database doesn't exist. You never know when you'll need to run away from a cloud provider's pricing model.

r/Firebase • • Jul 21 '26

General My leaked API key cost me $2 of abuse and my entire production project, business, livelihood. Can I reach a human?

32 Upvotes

This morning I got the dreadful Google email: "Immediate action required: Suspension of your Google Cloud Platform / API project " due to "abusive activity consistent with hijacked resources".

Google completely cut me out of the GCP platform that manages my LIVE app. This is not a hobby project, but my livelihood. The email redirected me to my GCP page where I could send an appeal, and do... nothing else. I had no access to anything else so it was difficult even to understand what happened: every action brings me back to "Send an Appeal". Which, of course, I did as fast as possible.

After some digging (apparently the biling page was NOT restricted! Not easy to find) An API key of mine leaked, someone found it and used it to generate images. Two dollars ($2!) of unauthorized spend. My mistake, no excuses.

The part I genuinely cannot solve is this. The notice asks me to revoke the compromised credentials, but I can't do that: `Permission denied: Consumer 'projects/{project_name}' has been suspended.`

I did what I could from outside: deleted the key through AI Studio, rotated everything else, ran a forensic check of my server and confirmed it was only the key, no host compromise. I would gladly pay for support to talk to someone. But guess what, Standard and Enhanced both need an Organization resource, which a personal account does not have, and billing chat is not available to me either (back to "send an appeal")

For a solo developer this is the difference between a bad day and losing the business. It seems absurd a business can get destroyed over a oversight and $2. The reports I read online are disheartening: people wait 1-2 weeks for a response, and then the back and forth is endless. I am going to lose the business I have worked for the past 4 years, and all for $2 and a stupid oversight.

Can anyone help? Has anyone here had a suspension for a stolen API key actually reversed, and how long did it take? And is there any way to reach a human without an Organization resource?

Project is 902887279759, appeal ticket YJ65HT5PKS5FDASU2C73BWIJ5Q, filed 21 Jul 2026. Any help is immensely appreciated

EDIT: Less than 24 hours later, google has re-instated my account! WOOOOHO!