Hi All, I’ve built a number of apps with android and quite recently a browser app. The android apps I have all call my API key from Firebase. On the 15th of this month I noticed a massive spike in usage but no real spike in downloads or usage of my apps. Looking through the daily usage breakdown …

I’m guessing you’re using Firebase functions to handle the requests? Do they trigger or is it explicitly called by the user? How are you handling errors? Does it return data or does it update another service like a database? It’s hard to say anything else without seeing your code. Instead of tryin…

How are your API keys managed? Are they server side env variable or managed key’s via an AWS, Azure, Google style key manager… or are they hard coded into the app?

Thanks for the replies guys. My apps currently use Firebase remote config to call the API key to the app. They are not hard coded in to the actual app.

Hmmm. Okay there’s your issue. You shouldn’t be using remote config for your API keys

If the app handed off the request to a cloud function which then made the OpenAI API call, you’d be golden. No way could it be intercepted by the user without them somehow having privileged access to your Firebase account or the infra it runs on. I’m guessing you’re using remote config to send the …

Thank you all for the advice. I will look to change the way the apps make the calls.

@ashxbl Hello! How did u store your api keys safely at the end? Should I use firebase cloud function to communicate with OpenAI service and then transfer the response back to app. I am using react native - firebase architecture and I am figuring out that securing key in the frontend is a big NONO.

Yes, you should make your openAI requests and store your key in some backend service, Firebase Cloud Functions is a good example. [image] API Key Management (unsure of where to start) API I’d probably start with looking at Firebase Functions unless you’re really excited a…

Hiya… Unfortunately it’s still on my list to do while I focus on other unrelated projects. The apps aren’t getting crazy traffic so it is easy for me to just keep an eye on and regularly rotate my keys. I’ve had no suspicious activity since my original post.

Thank you for your fast reply! I did some projects with Vercel and called api from /api directory, is that also considered to be safe way? (from my understanding it is, but it’s always good to check :smiley: )

My API is getting leaked.. need advice!

API

novaphil July 13, 2023, 2:56pm 9

Yes, you should make your openAI requests and store your key in some backend service, Firebase Cloud Functions is a good example.

Topic		Replies	Views
Securing Open AI API Keys API	2	660	April 30, 2024
Unauthorized API Key Usage API api	19	5730	September 13, 2023
Safety of using API with React Native- Firebase architecture API	5	1088	July 13, 2023
Repeated Fraudulent Use of My API Keys API api	6	983	November 17, 2023
Web implentation and keeping the API key private? API	26	12501	June 7, 2024

My API is getting leaked.. need advice!

Related topics