My API is getting leaked.. need advice!

I’m guessing you’re using Firebase functions to handle the requests? Do they trigger or is it explicitly called by the user? How are you handling errors? Does it return data or does it update another service like a database?

It’s hard to say anything else without seeing your code.

Instead of trying to track the usage I think you need to completely delete all your API keys and re-evaluate your code.