Add Cloud Firestore and Authentication to your Google AI Studio app

The Build mode in Google AI Studio can automatically set up and integrate Cloud Firestore and Firebase Authentication into web apps, which makes it easier to build apps with persistent data storage and secure login flows. With just a single prompt and a few clicks, you empower the Google AI Studio agent to set up a Firebase project, connect your app to that project, and generate all the Cloud Firestore and Authentication code directly in your app.

Overview: Add a backend to your Google AI Studio app

Describe your idea: Create a new app in Google AI Studio and describe a feature that requires a database or authentication. For example, you could enter the prompt: Build a shared to-do list app using Firebase as a backend.

Tip: For best results, explicitly ask the agent to use Firebase as the backend for your app.
Enable the Firebase integration: When prompted by the agent, enable Firebase, select a location for your project, and accept the Firebase Terms. The agent then automatically connects your app to your Firebase project and generates the necessary Cloud Firestore and Authentication code for your app, including a /src/lib/firebase.ts file and a firestore.rules file.
Deploy: Once ready, use the Share > Publish option to deploy your web app to Cloud Run.

Important: Before sharing or deploying your app, always review the AI-generated Firebase Security Rules.

Understand the shared quota for Cloud Firestore

All the Cloud Firestore databases provisioned by the Google AI Studio agent are placed in the same "group" of databases in your Firebase project. They all share these characteristics:

Shared quota: All databases in the group share a usage quota (see details below).
No Cloud Billing account required: You can build and test your app without adding billing. See details below about optionally adding billing.
Daily resets: If you hit a daily quota limit (for example, 50k reads/day), the service will pause for all databases within the group and resume the following day at around midnight Pacific Time.

Cloud Firestore databases in the shared quota group share the following limits:

Metric	Quota
Stored data	1 GiB total
Network egress	10 GiB per month
Write units	40,000 writes per day
Read units	50,000 reads per day
Real-time update units	50,000 updates per day

(Optional) Add billing to get more Cloud Firestore quota

If your app gains traction and you need to move beyond the no-cost limits for Cloud Firestore, you can upgrade your project to the pay-as-you-go Blaze pricing plan.

Add billing (if you haven't already): Navigate to the Firebase console and link a billing account to your project.
Upgrade the database: By default, Cloud Firestore databases created by the Google AI Studio agent continue to use the shared quota even after you upgrade your pricing plan. To enable full paid scaling for a specific database, you must manually move it out of the group by using a curl command.
- PROJECT_ID : Firebase project ID; find this ID in the Project Settings of the Firebase console.
- DATABASE_ID : Cloud Firestore database ID, which will match your applet ID; find this database ID in the Name column on the Cloud Firestore databases page in the Firebase console.
```
curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
"https://firestore.googleapis.com/v1/projects/PROJECT_ID/databases/DATABASE_ID?updateMask=free_tier_limited" \
-d '{"free_tier_limited": false}'
```

Important: Linking a Cloud Billing account doesn't automatically remove the shared quota caps.

Shared failure: If the shared quota is exhausted, all databases in the group will return errors. They don't have access to the linked billing account.
Additional usage: To enable additional usage for a specific database, you must move that database out of the shared quota group using the provided curl command. This converts that instance to a regular paid database where all usage is charged at Cloud Firestore rates.
Transition a database: Once a database has been moved out of the shared quota group and converted to a regular paid instance, you can reverse the boolean in the curl command to return it to the shared quota group. Note that all databases within the shared quota group must be the same edition and be located in the same region.

Security Rules generation

The Google AI Studio agent automatically generates Firebase Security Rules based on your app's logic. These Security Rules are designed to be "default deny," meaning end-users of your app can only access the data they own.

Note that if you manually adjust your Security Rules directly in the Firebase console, the Google AI Studio agent won't know about the changes, and they will be overwritten during subsequent app iterations. We recommend using the Google AI Studio agent to adjust your Firebase Security Rules to ensure your changes are preserved and aligned with your app's logic.

Use an existing project

You can also ask for the Google AI Studio agent to provision Cloud Firestore into an existing Google Cloud project that you own. Instruct the agent to use your existing project with a prompt such as:

Add Firestore to this app using project PROJECT_ID.

A new Cloud Firestore database will be provisioned into that project using the shared quota.
Firebase Authentication with Google Sign-In will be configured.
A service account will be granted access to your Cloud Firestore database. To allow administrator access from Google AI Studio, a new service account named ais-sandbox@PROJECT_ID.iam.gservice.com will be granted permission to access your Cloud Firestore database. This account is associated only with your Google AI Studio apps.
Limitations: If the Firebase project already has a Cloud Firestore database, the agent won't be able to add an additional one. You'll need to create a new, empty project to use.

Use the Firebase console

You can view your app's data and settings in the Firebase console. To access your projects associated with Google AI Studio, follow these steps:

Navigate to the Firebase console and select the project labeled AI Studio.
In the left navigation pane, click Build > Cloud Firestore Database to view and edit your data in Cloud Firestore, or click Build > Authentication to configure your Authentication settings and data.

Troubleshooting and FAQ

Find answers to common questions and learn how to resolve issues when integrating Firebase with your Google AI Studio app.

How is my Google Cloud / Firebase project selected?

When you use the Add Firebase backend feature, the Google AI Studio agent automatically selects a Firebase project to use for your app's backend services (Cloud Firestore and Firebase Authentication).

If you want to use a specific project instead, you can instruct the agent to do so with a prompt such as:

Use project PROJECT_ID for the Firebase backend.

If you later decide to publish your app to Cloud Run, it's important to continue using this same project. Choosing a different project will result in errors since it won't match the project used for your backend.

What authentication methods are supported?

The Google AI Studio agent sets up Google Sign-In when you use the Add Firebase backend feature. To set up additional methods, enable them in the Firebase console and ask the Google AI Studio agent for assistance updating your codebase.

Can I create a mobile app (like Android or iOS) with Google AI Studio?

Currently, the Google AI Studio agent can only create web apps. Learn more about what's supported in the Google AI Studio agent documentation.

Note, though, that just like all web apps, the apps created by Google AI Studio can be accessed as mobile web apps from browsers installed on mobile devices.

What is the `firebase-blueprint.json` file?

This is an intermediate file used by the Google AI Studio agent to understand your app's codebase. Don't modify this file manually, as it may cause the agent to generate incorrect code or insecure Security Rules.

What should I do if I get a "Quota exceeded" error?

Hitting a Cloud Firestore quota limit means your app has reached its daily usage cap for your Cloud Firestore database shared quota group. There are two ways to resolve this:

Option 1: Wait: Quotas reset daily around midnight Pacific Time.
Option 2: Upgrade: Upgrade to the pay-as-you-go Blaze pricing plan.
- If the Google AI Studio agent set up Cloud Firestore for you, you must then use the curl command described in Add billing to get more Cloud Firestore quota to move your database into a regular paid state. If you set up Cloud Firestore manually, then running the curl command isn't necessary.

What should I do if I get a "Missing or insufficient permissions" error?

This error occurs when your app attempts to read or write data to your Cloud Firestore database, but the request is rejected by your Security Rules. It indicates that the Security Rules are not allowing the attempted operation based on the current authentication state or data path. Click the Fix error button to prompt the Google AI Studio agent to attempt to correct the Security Rules.

What happens to my Firebase backend when I delete my Google AI Studio app?

Deleting your application in Google AI Studio doesn't automatically delete the connected Firebase project, Cloud Firestore database, or Firebase Authentication configurations.

If you added a Firebase backend, you must manually go to the Firebase console and delete the project or clean up individual resources (such as the Cloud Firestore database instance and Authentication providers) to ensure all data and configurations are removed.

Can the Google AI Studio agent delete or edit data in my Cloud Firestore database?

The Google AI Studio agent is designed to help provision the necessary backend resources and generate code and Security Rules. While the agent itself can't directly delete, edit, or manipulate data entries within your Cloud Firestore database, it can write code into your applet that is designed to perform these actions. To perform data management tasks, such as deleting entries, navigate to the Cloud Firestore database page in the Firebase console.

I belong to an organization that uses Google Cloud; can I connect my Google AI Studio app to an existing project within my organization's Google Cloud environment?

Ensure your Firebase project is placed within a particular Google Cloud organization folder:

Create your Firebase project manually ahead of time.
When setting up your Firebase backend in Google AI Studio, instruct the agent to use your existing project:
```
Add Firestore to this app using project PROJECT_ID.
```

Why can't I find certain documents in the Firebase console?

When the AI Studio agent saves data to a nested path (like /users/user1/messages/msg1) without first creating the parent document (user1), it creates what is known as a non-existent parent document. These documents aren't displayed in the Firebase console, which can make them difficult to find when browsing your Cloud Firestore database. While this doesn't affect how your app runs, you can often describe the issue to the AI Studio agent to prompt it to create the missing parent documents.

For more details, see Non-existent parent documents.

How does Google use my data (for example, code and prompts) in Google AI Studio?

Refer to the Gemini API Additional Terms of Service for details on how your data is used.

I received an email from Google Cloud about a "publicly accessible Google API key for your Google Cloud project". What do I need to do?

If you've received an email from Google Cloud about a "publicly accessible Google API key for your Google Cloud project" and the API key listed in the email is your Firebase API key, then make sure that the API key meets the following requirements to be safe to include in your code or configuration files. You can verify the following in the APIs & Services > Credentials panel in the Google Cloud console.

It's the API key that you use for your Firebase app and only for Firebase services. These keys are usually called Browser key (auto created by Firebase) or Android key (auto created by Firebase) or iOS key (auto created by Firebase).
It has all the required Firebase-related APIs included in the key's "API restrictions" allowlist.
It does not have any other APIs in its "API restrictions" allowlist. In particular, the list should not have Generative Language API.

Also, make sure that you're using Firebase Security Rules and App Check as recommended for the Firebase products that you use.

You can learn details about API keys for Firebase and find a list of FAQs in Learn about using and managing API keys for Firebase

Important: The API key that you use for calls to the Gemini Developer API in your app should never be included in your code or configuration files. It must be protected from public exposure. In the Google Cloud console, it will be called Gemini API Key or Gemini Developer API key (auto created by Firebase), and it will be restricted to the Generative Language API.