Short answer
Stop the spend first: in the Google Cloud console, check the API metrics to see which key made the calls, then rotate it and restrict or delete every API key that allows the Generative Language API and isn’t a server-side Gemini key. If you can’t find the key fast, you can disable billing on the project, after checking what that takes down. Then move Gemini calls behind your server, turn on App Check for the Firebase services your app uses, set spend cap budgets where Firebase supports them, and keep an alert budget on the whole project. Budget alerts only warn you; they don’t stop charges.
Why it happens, and the fix
01
A public Firebase key is allowed to call Gemini
“never include the Gemini Developer API in the allowlist for a publicly accessible API key” Firebase, Learn about using and managing API keys for Firebase
Firebase API keys ship inside your web or mobile app, so anyone can read them. That’s fine for Firebase services, which rely on Security Rules and App Check, but not for the Gemini API. Open APIs & Services > Credentials, check each key’s API restrictions, and remove the Generative Language API from any key your app ships with.
02
The Gemini key is in your code or config
“use a separate API key and restrict it to the applicable API” Firebase, Learn about using and managing API keys for Firebase
A Gemini key in client code, a config file or a public repo can be copied and used from anywhere. Delete it in the Google Cloud console, create a new one restricted to the Generative Language API, and call Gemini only from your server or a Cloud Function, never from client code or config.
03
The budget only sent an email
“Budget alerts do not pause services.” Firebase, Avoid surprise bills
An alerts-only budget emails you when spending crosses a threshold but keeps services running, so a night of abuse can finish before anyone reads it. Spend cap budgets pause a service for the rest of the month, but only a few Firebase services support them. Set caps where you can, and keep an alert budget with low thresholds on the project.
04
The service you use has no spend cap
“Spend caps budgets are only available for the following Firebase services: Firebase AI Logic, Firebase App Hosting, Cloud Functions for Firebase, and Firebase Extensions.” Firebase, Avoid surprise bills
If your Gemini calls run through a raw API key rather than Firebase AI Logic or Cloud Functions, no Firebase spend cap covers them. Running the calls through one of the capped services, such as Firebase AI Logic or Cloud Functions, lets you set a spend cap budget that pauses that service at 100% for the rest of the month.
Checked against the vendor’s docs on : Firebase: API keys for Firebase; Firebase: Avoid surprise bills; Google Cloud: Best practices for managing API keys.
Rather hand it over?
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- $750Firebase Cost-Cut AuditWhere your Firebase or Google Cloud bill goes, with savings ranked by dollars a month and risk.See scope and start
- from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
Related: How to cut your Firebase bill · Firebase App Check blocking requests · Firebase insecure rules alert