title: Firebase browser key API restrictions
body: <p>When creating a new project Firebase generates browser API keys automatically in the <a href="https://console.cloud.google.com/apis/credentials" rel="noreferrer">GCP API credentials</a>. This is the same API key that is set in the Firebase Web client SDKs and is publicly available.</p>
  
  <p>By default the key has no restrictions, so it's prone to quota stealing for every API enabled for that project. Surprisingly I have not found information about securing this key in the Firebase documentation.</p>
  
  <p>So I took two extra steps to secure the key:</p>
  
  <ol>
  <li>Added HTTP referrer restriction to allow requests from my domain only.</li>
  <li>Added <strong>Identity Toolkit API</strong> to the list of allowed APIs. Experimentally I've figured out that it's enough for Firebase Auth and Firestore to work.</li>
  <li>Added <strong>Token Service API</strong>. This is needed for refresh tokens to work and keep the authentication.</li>
  </ol>
  
  <p>My question is mostly related to points #2-3. What are the APIs that needs to be enabled for various components of Firebase to work on the web?</p>