When you're ready to launch your app and have real end users interact with your app's AI features, make sure to review this checklist of best practices and important considerations.
General
Review the general launch checklist for apps that use Firebase
This Firebase launch checklist describes important best practices before launching any Firebase app to production.
Make sure your Firebase projects follow best practices
For example, make sure that you use different Firebase projects for development, testing, and production. Review more best practices for managing your projects.
Access and security
Review the general security checklist for apps that use Firebase
This security checklist describes important best practices for access and security for Firebase apps and services.
Enforce Firebase App Check
Firebase App Check helps protect the APIs that give you access to the Gemini and Imagen models. App Check verifies that requests are from your actual app and an authentic, untampered device. It supports attestation providers for Apple platforms (DeviceCheck or App Attest), Android (Play Integrity), and Web (reCAPTCHA Enterprise), and it supports all these providers for Flutter and Unity apps, as well.
Also, consider enforcing replay protection, which means tokens are one-time-use only. This option offers enhanced protection beyond the baseline protection and lets you set an appropriate level of protection for your app and use cases.
Set up restrictions for your Firebase API keys
Review each Firebase API key's "API restrictions" allowlist:
Make sure that the Firebase AI Logic API is in the allowlist.
Make sure that the only other APIs in the key's allowlist are for Firebase services that you use in your app. See the list of which APIs are required to be on the allowlist for each product.
Set "Application restrictions" to help restrict usage of each Firebase API key to only requests from your app (for example, a matching bundle ID for the Apple app). Note that even if you restrict your key, it's still critical that you set up Firebase App Check to help secure your app against API abuse.
Note that Firebase-related APIs use API keys only to identify the Firebase project or app, not for authorization to call the API.
Restrict requests to only authenticated users
Enforce authenticated-users mode in your Firebase project so that all calls from your app via Firebase AI Logic must come from authenticated users of your app (otherwise, the request is blocked).
Billing, monitoring, and quota
Avoid surprise bills
If your Firebase project is on the pay-as-you-go Blaze pricing plan:
(Gemini Developer API only) Set up spending caps.
Set up AI monitoring in the Firebase console
Set up AI monitoring to gain visibility into key performance metrics, like requests, latency, errors, and token usage. AI monitoring also helps you inspect and debug your Firebase AI Logic features by surfacing individual traces.
Review your quotas for the required underlying APIs
Make sure that you understand the quotas for each required API.
Set rate limits per user (the default is 100 RPM).
Edit quota or request a quota increase, as needed.
Management of configurations
Use a stable model version in your production app
In your production app, only use
stable model versions (like
gemini-3.5-flash). Do not use a preview or experimental version or
a -latest
Use Firebase Remote Config or server prompt templates
When you use Remote Config or server prompt templates, you can control important configurations for your app's AI features in the cloud (server-side) rather than hard-coding values in your code. This means that you can update your configurations without releasing a new version of your app.
(Strongly Recommended) Make on-demand changes to the model name used for your AI feature as new models are released or others are shut down. See details for using Remote Config or server prompt templates.
(Optional) Dynamically and even conditionally control other parameters for your AI feature, for example the model configuration (like max output tokens), safety settings, system instructions, and prompt data. See details for using Remote Config or server prompt templates.
(Optional) Set a
minimum_versionparameter in Remote Config to compare the app's current version with the Remote Config-defined latest version, to either show an upgrade notification to users or force users to upgrade.
Set the location for accessing the model
| Only available when using the Agent Platform Gemini API (formerly Vertex AI) as your API provider. |
Setting a location for accessing the model can help with costs as well as help prevent latency for your users.
If you don't specify a location, the default is us-central1. You can set this
location during initialization, or you can optionally
use Firebase Remote Config to dynamically change the location based on each user's location.