Secure Firebase REST APIs at a client level (not end user level)

Question

I am trying to create a REST API (via Firebase cloud functions ) and release it to my clients to allow them creating their mobile apps. The mobile apps they will be creating are used by public users. However, users are not supposed to deal with our APIs and thus authentication. So I don't need end user authentication. It's up to our clients (app makers) to use a "client id" and an "api key" . Based on what I have researched, Firebase Admin SDK might not be a good solution for this end since we're concerned about client level authentication.

I am looking for a standard solution to generate api-keys for the 3rd party clients. This key generation is not a manual process but rather a service that clients will use to obtain a key. Something like google map api for 3rd party developers. We want to keep track of whitelisted clients without needing their app users to deal with authentication.

I'd appreciate suggestions and guidelines to find the best solution for our REST APIs.

Answer 1

The first solution that comes to my mind is thew new Firebas App Check . It would restrict any access beside the Apps and Web pages you have whitelisted for your project. I don't know if that is possible in your usecase (how the cooperation with the other apps look like) but I would deffinitely try this first.