Next.js Discord

Discord Forum

Firebase nextjs ,problem with enviroment variables.

Answered
Florida White posted this in #help-forum
Open in Discord
Florida WhiteOP
Hello. I would like to connect my application with firebase ,but I have a problem with enviroment variables. When I create firebase-config I want to take API_key from env.local ,but if dont use NEXT_PUBLIC for that enviroment varible then I cant using this.. :/ I dont want to use NEXT_PUBLIC ,because client should not see my api key. So how I can use proccess.env without NEXT_PUBLIC? I am using nextjs 13 


import { initializeApp } from "firebase/app";
import { getAuth } from "firebase/auth";


const firebaseConfig = {
    apiKey: process.env.FIREBASE_API,     <-- it works only with NEXT_PUBLIC 

};
console.log("object");

const app = initializeApp(firebaseConfig);

export const auth = getAuth(app);
Answered by Clown
Unlike how API keys are typically used, API keys for Firebase services are not used to control access to backend resources; that can only be done with Firebase Security Rules (to control which users can access resources) and App Check (to control which apps can access resources).

Usually, you need to fastidiously guard API keys (for example, by using a vault service or setting the keys as environment variables); however, API keys for Firebase services are ok to include in code or checked-in config files.
View full answer

5 Replies

Clown
Unlike how API keys are typically used, API keys for Firebase services are not used to control access to backend resources; that can only be done with Firebase Security Rules (to control which users can access resources) and App Check (to control which apps can access resources).

Usually, you need to fastidiously guard API keys (for example, by using a vault service or setting the keys as environment variables); however, API keys for Firebase services are ok to include in code or checked-in config files.
Answer
Clown
Its fine for those keys to be public, if for some reason its not working without NEXT_PUBLIC_. Just make sure to use Firebase security rules to restrict access before deployment
Florida WhiteOP
ok super ,thanks i will do it
joulev
btw the above does not apply to firebase-admin environment variables. the admin SDK env vars must not be exposed to the browser
Clown
The firebase-admin sdk is supposed to be hosted being entirely server based separately anyways iirc.