Why You Should Never Embed Your Gemini API Key in Client Code (And How Firebase AI Logic Fixes It)
The explosion of generative AI has pushed thousands of web developers to add intelligent features to their apps.
The first instinct is usually to call the Gemini API's SDK directly from the browser. That instinct comes with a serious security risk: exposing your API key to the world.
In this article, you'll learn why shipping a raw Gemini API key to the client is dangerous, how Firebase AI Logic's proxy architecture solves it, and how Firebase App Check closes the second half of the problem that a proxy alone doesn't fix.
By the end, you'll have a working, production-style setup: a protected AI Logic client, a properly configured App Check flow (debug token included), and real usage patterns—streaming, multi-turn chat, and structured JSON output—not just a single console.log.
Table of Contents
- Prerequisites
- The Problem With Client-Side API Keys
- Step 1 – How Firebase AI Logic's Proxy Architecture Works
- Step 2 – What Firebase App Check Actually Does
- Step 3 – Set Up Your Firebase Project
- Step 4 – Integrate Firebase App Check
- Step 5 – Implement Firebase AI Logic
- Debugging Common Issues
via FreeCodeCamp