Restrict requests to only authenticated users

You can enforce authenticated-users modefor your Firebase project. When enforced, all Gemini API requests via Firebase AI Logic must come from authenticated users of your app. Specifically, the end user of your app must be authenticated using Firebase Authentication before they send a request to Firebase AI Logic from your app. If the end user is unauthenticated, the request is blocked.

When a request is blocked, the response will be a 401: unauthenticated error.

Important considerations

Be aware of the following important considerations for authenticated-users mode.

When authenticated-users mode is enforced

When authenticated-users mode is enforced, be aware of the following:

• This setting is a project-widesetting for Firebase AI Logic .

  • It applies to all apps registered in the project.
  • It only applies to the project where it's enforced.

• This setting blocksall requests via Firebase AI Logic that do not send Firebase Authentication credentials.

  • The user must be authenticated via Firebase Authentication before sending the request to Firebase AI Logic .
  • This setting applies to all requests via Firebase AI Logic to both the Gemini Developer API and the Vertex AI Gemini API .
  • This setting applies to all requests that use server prompt templates .
  • This setting cannot be applied on a per-user, per-API, or per-template basis.

• This setting does not block Gemini API requests in your project that are not via Firebase AI Logic .

• If you're using hybrid / on-device :

  • This setting blocksrequests to the cloud-hosted model if the user is unauthenticated.
  • This setting does not blockrequests to the on-device model no matter the authentication state of the user.

• If you're using the Gemini Live API :

  • This setting blocksusage of the Gemini Live API for web apps when using Firebase AI Logic — even for authenticated users. This includes web apps using the Firebase JS SDK or Flutter web apps.

• If you're using the Firebase AI Logic REST API :

  • This setting blocks inference requests that do not send Firebase Authentication credentials. This includes requests for server prompt templates like templateGenerateContent or templateStreamGenerateContent .
  • This setting does not block control-plane requests (like those for managing templates and configurations) because they are guarded by IAM.

• This setting does not blockrequests to countTokens (the Count Tokens API).

Before enforcing authenticated-users mode

Be aware of the following before you enforce authenticated-users mode:

• If you have existing versions of your app that do not use Firebase Authentication :

  • This setting will blockrequests via Firebase AI Logic from those existing app versions.
  • Make sure that all active clients have been updated to use Firebase Authentication before enforcing authenticated-users mode.

• Older Flutter plugin versionsrequire special instantiation to send Firebase Authentication credentials with requests.

  • If your app uses the Flutter plugin firebase_ai v3.11.0 or lower (BoM v4.12.0 or lower) and does not pass in Authentication during instantiation, this setting will blockrequests via Firebase AI Logic — even for authenticated users.
  • Make sure that all active clients for Flutter have been updated to a newer version of the plugin before enforcing authenticated-users mode.

Special instantiation required for Flutter if using older plugin versions

This special instantiation is only required if your app uses the Flutter plugin firebase_ai v3.11.0 or lower (BoM v4.12.0 or lower). If your app uses a newer version of the plugin, this special instantiation isn't needed.

If you enforce authenticated-users mode, then in Flutter apps that use older plugin versions, you need to explicitly pass in Authentication during instantiation, like so:

  // ... 
 final 
  
 ai 
  
 = 
  
 await 
  
 FirebaseAI 
 . 
 googleAI 
 ( 
  
 auth: 
  
 FirebaseAuth 
 . 
 instance 
 , 
  
 // for Flutter, pass in Authentication explicitly 
 ); 
 // ...