Calling the Gemini API with an unrestricted Firebase browser key caused a €54k spike in 13 hours

Right after attaching Firebase AI Logic to an existing Firebase project, automated traffic unrelated to actual users surged over 13 hours, resulting in a bill of €54,000+.

The project had originally been used only for Firebase Authentication, and the problem was that the browser API key lacked proper restrictions. The abnormal traffic was concentrated overnight, and it only stopped after the API and credentials were suspended and rotated.

The operational response was also slow.

• There were €80 budget alerts and cost anomaly detection alerts, but they were delayed by several hours.
• By the time of the response, costs had already climbed to around €28,000.
• The final bill was confirmed at €54,000+ due to delayed reporting.

The author shared Google Cloud support and logs, but the request was classified as valid usage and the billing adjustment was denied. In other words, even though this was abnormal usage unrelated to the service's intent, cost responsibility remained because the traffic originated from the project.

Google's response was also attached. The key points are as follows.

• The Gemini API has tier spend caps and project spend caps, both of which have a reporting delay of about 10 minutes.
• Going forward, the direction is to prevent the use of unrestricted API keys.
• New users will have safer Auth keys generated by default.
• In some cases, keys are automatically blocked if exposed on the public web.
• Keys created in Google AI Studio are restricted to Gemini API only by default, but keys created through other Google Cloud paths may allow cross-service use, so this needs to be double-checked.
• They recommended not placing keys in client-side code where possible, and moving them to server-side when necessary.
• They also noted that prepaid billing is being introduced for new US billing accounts.

Ultimately, this case shows that a key exposed in the browser combined with slow cost visibility can lead to a massive billing incident in a short amount of time. App Check, quota, and server-side migration alone may not be enough, and this serves as a cautionary example that spend caps and key restriction settings are effectively essential for the Gemini API.