tldr: I too think that Google could have handled it differently and better but still there is a skill issue and since we have so many posts, blaming Google I thought it's time to show the other side of the coin.
--
Since we read almost everyday another billing horror story I just want to provide some context for newbies. If you used Firebase or Google Maps in the past (before vibe coding, in a time where you needed a little bit of skill and knowledge at least) you knew that you provide a service to the public which you have to pay for.
That is very important to understand: If you use Google Maps on your public website or you have public website that reads from a Firestore you have to pay for ALL the usage of the public.
That's not cruelty or greed. There isn't an alternative. You provide a service to the public, you have to pay for the usage of the public.
If someone starts to spam your site and reloads it with a script 1000 times per second you have to pay for all the Firebase reads, Maps calls etc. So we always knew we have to secure against that.
That's the price for this kind of architecture (Firebase) which on the other hand removes the need for backends and made web development way easier.
What changed? The Gemini API is useful for bad actors.
An unrestricted Firebase key was not very useful for bad actors, so abusing it was useless. It happened but not that often. The Gemini API on the other hand is of course super valuable for bad actors. This is why we abuses spiked.
There was no policy change or so from Google. Your Firebase and Maps API keys still have to be public.
If you want to integrate generative AI in your public Firebase Project, you, again, expose a costly service to the public. That's why you have to pay for it. So if you do that (BE CAREFUL) you have restrict the public usage.
Why is there no hard spending limit?
Google had two arguments in the past (both make sense to me):
It's hard to implement a hard spending limit that guarantees safety.
Think about it, every API we use, we want speed. A check if you have spent your allowance costs a lot of time, combine that with distributed systems, parallel requests - it's getting complicated.
A spike can be a good sign.
Google is a hyperscaler. If you build a service with Firebase and your app, game, etc. becomes an overnight viral sensation you don't want your service to be shut down.
It's not a business case!
I read often, that Google is making money with these situations. Sorry but don't be ridiculous. As hard it is for us personally to have a bill of 20k - those are peanuts for Google. All their Services cost nothing for 90% of the people here, because the projects are so small. I have customers, making hundred of millions revenue each year and pay maybe 50 usd per month for one of their most important APIs we host on GCP.
If they need that kind of money, wouldn't it be easier to just increase the price of the services? You know, make money without the bad PR and the hassle?
Why are API keys not secret?
API keys don't have to be secret. Most are, but API keys are in the end just an identifier to let the service know, who uses the API. Some need to be private, some not.
What do you need to do?
The same we've always done:
- Restrict your API keys (and Service Accounts)
Follow the principle of least privilege - every API key should only be able to use the service it needs.
- Set measures to prevent abuse
In Firebase projects use App Check, Security Rules etc.
- Protect yourself against Dos Attacks
Use for example Cloudflare
- Think about which service you provide to the public!!!
If you have a chat bot on your website, that uses Gemini, than you provide Gemini to the public. There is no way around! So you are responsible to find ways to prevent abuse. Not Google.
- Learn the basics!
Your AI is not responsible for your code quality. You are. If you write "make it secure" it's still your responsibility. GCP, AWS, Azure those are professional tools, for professionals. The USP of Google is accessiblity. They invite beginners, they make it easy. They have so many blog posts, videos and tutorials to start AND secure your project. Read those.
- Don't use secret API keys in your code, don't push them to Git etc.
So that's it.
