Restricting Firebase API Keys : <p>I've been toying around with Firebase, and after reading the documentation (and other SO questions), I'm still confused on some of the API keys. I'm using Firebase for Analytics, Crashlytics, and Performance. But also have it linked to Google Play and AdMob. </p>

<p>When I set it up for the first time, 3 API keys were created in the developer console.</p>

<ol>
<li>Browser key (auto created by Google Service)</li>
<li>Android key (auto created by Google Service)</li>
<li>Server key (auto created by Google Service)</li>
</ol>

<p>I tried reading through the documentation to find where it is described how these keys are used, but I wasn't able to find it. From looking around the Firebase application, it looks like the <code>Android Key</code> is used as the <code>Web API Key</code>, and the <code>Server Key</code> is used as the <code>Cloud Message Legacy Server Key</code> (Although, I don't use Cloud Messaging). I'm not sure how Firebase is using the <code>Browser Key</code>.</p>

<p><strong>What I'm trying to do is restrict these keys as much as possible to prevent any malicious use of them.</strong></p>

<p>I added the following API restrictions</p>

<ol>
<li>Android Key

<ul>
<li>Firebase Services API</li>
</ul></li>
<li>Server Key

<ul>
<li>Firebase Cloud Messaging API</li>
</ul></li>
<li>Browser Key

<ul>
<li>Firebase Services API</li>
</ul></li>
</ol>

<p>I'm not entirely sure if these restrictions are correct for what I am using them for, but it worked for the <code>Android Key</code> and the <code>Server Key</code>, at least as far as I can tell. However, the <code>Browser Key</code> restrictions appear to not work as Firebase is creating a new <code>Browser Key</code> when I redeploy my application.</p>

<p>To sum up my question, I can see that Firebase is auto creating API keys for me, but I cannot find any documentation that talks about how these keys are used for the basic features of Firebase that I'm using. I'm also not entirely sure how I can restrict these keys, especially the <code>Browser Key</code>.</p>
