I have a GCP project using Firebase, with two applications. One is used only for the Firebase Authentication tool in my main web app (not hosted with Firebase) – call it APP1.

The other one is an internal app, hosted with Firebase Hosting (also using Firebase Auth) – call it APP2.

APP1 has an API key automatically created by Firebase, on which I configured some restrictions (on the APIs it can use) – call it KEY1.

Now every time I deploy APP2, it seems to create a new API key (visible in the GCP console “API and services”/”credentials” page), with a default set of APIs enabled (call it KEY2, though there may be several of them).

I configure the firebase SDK in APP2 to use the API key KEY1: no part of my code is using the key KEY2. However, when I log in to APP2, it still seems to make some API calls to the google.cloud.identitytoolkit.v1.ProjectConfigService.GetProjectConfig API using KEY2. I absolutely can’t wrap my head around why Firebase would do this, and the documentation has been unhelpful. Is anyone around familiar with Firebase and how it handles API keys?