Should I add the google-services.json (from Firebase) to my repository?

Question

I just signed up with Firebase and I created a new project. Firebase asked me for my app domain and a SHA1 debug key. I input these details and it generated a google-services.json file for me to add in the root of my app module.

My question is, should this .json file be added to a public (open source) repo. Is it something that should be secret, like an API key?

Josphinejoss

Answer 1

A google-services.json file is, from the Firebase doc:

Firebase manages all of your API settings and credentials through a single configuration file.
The file is named google-services.json on Android and GoogleService-Info.plist on iOS.

It seems to make sense to add it to a .gitignore and not include it in a public repo.
This was discussed in issue 26, with more details on what google-services.json contains.

A project like googlesamples/google-services does have it in its .gitignore for instance.
Although, as commented by stepheaw, this thread does mention

For a library or open-source sample we do not include the JSON file because the intention is that users insert their own to point the code to their own backend.
That's why you won't see JSON files in most of our firebase repos on GitHub.

If the "database URL, Android API key, and storage bucket" are not secret for you, then you could consider adding the file to your repo.
As mentioned in "Is google-services.json safe from hackers?", this isn't that simple though.

baueric asks in the comments:

In that post he says:

The JSON file does not contain any super-sensitive information (like a server API key)

But the google-services.json does have entry called api_key.
Is that a different api key than a "server api key"?

Willie Chalmers III points to "Is google-services.json safe from hackers?", and adds:

Yes, that API key isn't a server API key which should never be public, so it's fine if your google-services.json is visible by others.

In any case, you should still restrict how your client API key can be used in the Google Cloud console.

---

As noted by Puzz in the comments, see also "Is it safe to expose Firebase apiKey to the public?"

In that answer, Frank Van Puffelen mentions:

Update (May 2021): Thanks to the new feature called Firebase App Check, it is now actually possible to limit access to the backend services in your Firebase project to only those coming from iOS, Android and Web apps that are registered in that specific project.

Maomaoism

This isn't actually correct; a Firebase engineer said it's okay to check into source control. @Yaron's answer stands. – Branching

@WillieChalmersIII OK. I have amended the answer accordingly. – Maomaoism

@WillieChalmersIII In that post he says "The JSON file does not contain any super-sensitive information (like a server API key)" but the google-services.json does have entry called api_key. Is that a different api key than a "server api key"? – Farrell

@Farrell See this answer for more info. Yes, that API key isn't a server API key which should never be public, so it's fine if your google-services.json is visible by others. In any case, you should still restrict how your client API key can be used in the Google Cloud console. – Branching

Here you can see more detailed explanation. #37482866 – Addend

You can care about the security issue with firebase app check not securing google-service.json. – Addend

@Puzz Thank you for that feedback. I have included your comment and its reference in the answer for more visibility. – Maomaoism

Answer 2

From this discussion it seems you can add it to a public repo. Its content ends up in the APK anyway and is probably easy to extract.

Combative

I agree, and I'm working on this issue right now. Is there a way to encrypt the keys in that file from somebody decompiling the APK? – Edacity

While it is definitely true that API keys can easily be extracted from an apk, the question was about whether google-services.json should be committed to source control in a public open source repo. And in the vast majority of cases the answer is definitely NO - unless the repo owner wants the whole world to use their Google account API quota by default. @VonC's answer stands. – Schaub

hitraj47 asked about adding it to a public repository. That discussion doesn't mention public repositories, and they seem to be discussing a private repository. – Sezen

Please notice, keys can be protocted using signature and signing. Thus there is no problem for others to see the keys as they can't use it without your signing key – Cinquain

Can you explain? if I protect this key with another key, than ultimately my app needs the 2nd key to use the 1st key. So I end up in the same problem of where to keep that key in the repository. – Combative

BTW, 'google-services.json' is added to '.gitignore' file by default e.g. when creating project on GitHub and selecting predefined sample. – Playwriting

Answer 3

It says the content of this file is public in the Firebase Documentation:

The content of the Firebase config file or object is considered 
public, including the app's platform-specific ID (Apple bundle ID or
Android package name) and the Firebase project-specific values, like
the API Key, project ID, Realtime Database URL, and Cloud Storage 
bucket name. Given this, use Firebase Security Rules to protect your
data and files in Realtime Database, Cloud Firestore, and Cloud Storage.

Ectophyte

Answer 4

Official documentation says the file does not contains any secret key.

Check https://firebase.google.com/docs/android/setup#add-config-file

Schorl

Answer 5

responding @Yaron last comment. based on my limited knowledge and use of firebase.

in firebase project console (where you download google-services.json) and get the API key. you put the app ID and also you provide an SHA certificate. so for the request to work it needs to be from the app corresponding with the same app ID and certificate.

so there is no 2end key in the codebase to hide. The back end verify.

Amanita