How to Fix Firebase “API key not valid”

API key not valid. Please pass a valid API key.

API_KEY_INVALID

API key not valid

What Does “API key not valid” Mean?

A Firebase Android application may report:

com.google.firebase.FirebaseException: An internal error has occurred. [ API key not valid. Please pass a valid API key. ]

A REST response may instead contain:

{ "error": { "message": "API_KEY_INVALID" } }

In a standard Android Firebase setup, the API key normally comes from google-services.json and is converted into Android resources by the Google Services Gradle plugin.

google-services.json ↓ Google Services Gradle Plugin ↓ google_api_key ↓ Firebase SDK

Common Situations

• An old google-services.json is still in the project
• The JSON belongs to another Firebase project
• The API key was deleted in Google Cloud Console
• Application restrictions were changed
• Required Firebase APIs were removed from API restrictions
• The Android package restriction does not match the current application ID
• Debug and Release use different package names
• Product flavors were added without updating Firebase configuration
• The API key was manually edited
• A key from another project was copied into the app
• CI/CD restores an outdated Firebase configuration

Cause 1: google-services.json Is Outdated

If an API key was deleted or replaced in Google Cloud but the Android project still contains an older Firebase configuration file, the app may keep sending the invalid key.

Google’s Firebase documentation recommends obtaining an updated Firebase configuration file when an API key has become invalid. :contentReference[oaicite:24]{index=24}

Solution 1: Download a Fresh google-services.json

Firebase Console → Project settings → General → Your apps → Android app → Download google-services.json

Replace the old file, normally at:

app/google-services.json

Cause 2: The API Key Belongs to Another Firebase Project

A Firebase configuration includes both the Firebase project ID and API key.

If the key was created for a different Google Cloud/Firebase project, the configuration is inconsistent.

Firebase explicitly lists a key created for a different Project ID than the one in the app’s Firebase configuration as a reason that a key may be invalid. :contentReference[oaicite:25]{index=25}

Solution 2: Compare project_id and the API Key Project

Open google-services.json:

"project_info": { "project_id": "my-firebase-project" }

Then locate:

"api_key": [ { "current_key": "AIza..." } ]

Open that same project in Google Cloud Console and verify that the key exists there.

Cause 3: The API Key Was Deleted

If a key embedded in a released Android app or Firebase configuration is deleted from the Google Cloud project, requests using that key can no longer work.

Firebase’s current documentation explicitly identifies a deleted API key as a common reason for an invalid-key error. :contentReference[oaicite:26]{index=26}

Solution 3: Download an Updated Firebase Configuration

Rather than manually replacing individual values, obtain an updated google-services.json for the registered Android application.

Cause 4: Application Restrictions Do Not Match the Android App

An API key can be restricted to Android applications using values such as:

Android package name SHA-1 certificate fingerprint

Firebase documents mismatched Application Restrictions as a cause of invalid API keys. :contentReference[oaicite:27]{index=27}

Solution 4: Check Application Restrictions

Google Cloud Console → APIs & Services → Credentials → API key → Application restrictions

If the key is restricted to Android applications, verify the package name and certificate fingerprint.

Check the Current applicationId

android { defaultConfig { applicationId = "com.example.myapp" } }

Remember that product flavors and applicationIdSuffix can modify the final value.

Cause 5: Debug and Release Use Different Package Names

buildTypes { debug { applicationIdSuffix = ".debug" } }

This produces:

Release: com.example.app

Debug:
com.example.app.debug

An API key restricted only to com.example.app may not match the Debug application.

Solution 5: Register the Debug Application

Register:

com.example.app.debug

as another Firebase Android app if required.

A Debug-specific Firebase configuration can be placed at:

app/src/debug/google-services.json

Cause 6: API Restrictions Are Too Strict

A Google Cloud API key can be restricted to a specific allowlist of APIs.

API restrictions → Restrict key

If an API required by the Firebase service is removed from the allowlist, Firebase requests can be blocked.

Google’s Firebase documentation states that incorrect API restrictions can produce API_KEY_SERVICE_BLOCKED or Forbidden 403 errors and recommends ensuring that all required Firebase-related APIs are in the key’s allowlist. :contentReference[oaicite:28]{index=28}

Solution 6: Review API Restrictions

Google Cloud Console → APIs & Services → Credentials → API key → API restrictions

Verify that APIs required by the Firebase products you use are permitted.

Cause 7: A Manually Created API Key Is Being Used

A manually created Google Cloud key may not have application restrictions compatible with the Firebase Android application.

Solution 7: Use the Key Selected by Firebase

Download a fresh Firebase configuration file.

Firebase’s documentation explains that when it generates an app configuration, it attempts to select an API key whose Application Restrictions match that app. :contentReference[oaicite:30]{index=30}

Cause 8: The API Key Is Hard-Coded

In a normal Firebase Android project, there is usually no reason to manually declare:

val apiKey = "AIza..."

Solution 8: Return to the Standard Firebase Configuration

google-services.json ↓ Google Services Gradle Plugin ↓ Firebase SDK

Cause 9: google-services.json Was Edited Manually

Replacing only:

"current_key": "AIza..."

with a key from another project can break the relationship between the API key, Firebase App ID, project ID, and registered client.

Solution 9: Download the Configuration Again

Use Firebase Console rather than manually editing the file.

Cause 10: Product Flavors Use Different Firebase Projects

For example:

development production

may intentionally connect to different Firebase projects.

Solution 10: Use Flavor-Specific JSON Files

app/ └── src/ ├── development/ │ └── google-services.json └── production/ └── google-services.json

This ensures each variant uses the correct project and API key.

Cause 11: CI/CD Uses an Old Configuration

If local builds work but CI fails, the CI secret or artifact may contain an older Firebase configuration.

Solution 11: Verify the CI Firebase Project

Check the restored:

app/google-services.json

without printing the full API key in public logs.

Compare the project ID and configuration source with the local working version.

Cause 12: Firebase Authentication Requests Fail

Firebase Authentication client requests can use the Firebase API key.

Google notes that while the Firebase API key does not authorize access to your Firestore or Storage data, it can be used to call Firebase Authentication endpoints. :contentReference[oaicite:31]{index=31}

Solution 12: Check Authentication-Related API Restrictions

Google Cloud Console → APIs & Services → Credentials → API key → API restrictions

Make sure required Firebase Authentication-related APIs have not been removed from the allowlist.

Is a Firebase API Key a Secret?

Google’s current Firebase documentation states that API keys used for Firebase services identify the project or app but are not themselves the authorization mechanism for Firebase data access. :contentReference[oaicite:32]{index=32}

That is why a Firebase API key can normally appear in google-services.json and in the compiled Android application.

Actual Firebase data security should rely on:

Firebase Security Rules Firebase App Check Google Cloud IAM

where applicable. :contentReference[oaicite:33]{index=33}

Can Someone Access My Firebase Database with Only the API Key?

Not simply because they know the API key.

Firebase states that API keys are not used to authorize Firestore, Realtime Database, or Cloud Storage data access. Security Rules control that access. :contentReference[oaicite:34]{index=34}

Use Firebase App Check

Firebase also recommends App Check to help protect supported Firebase backends from requests originating from unauthorized clients. :contentReference[oaicite:35]{index=35}

API restrictions, Security Rules, and App Check serve different purposes.

Cause 13: The Same Key Is Used for Non-Firebase APIs

Using one Firebase key for Maps, Places, or unrelated Google Cloud APIs makes restrictions harder to manage.

Firebase recommends creating separate restricted API keys for non-Firebase Google Cloud APIs. :contentReference[oaicite:36]{index=36}

Solution 13: Separate API Keys by Purpose

Firebase services → Firebase API key

Maps / Places / other APIs
→ Separate API-specific key

This reduces the chance that changing restrictions for one service breaks Firebase.

Check Whether the API Key Still Exists

Open:

Google Cloud Console → APIs & Services → Credentials

Firebase’s current documentation identifies this page as the place to view and manage API keys for the project. :contentReference[oaicite:37]{index=37}

Inspect the API Key in google-services.json

Search for:

"current_key"

macOS or Linux:

grep -n '"current_key"' \ app/google-services.json

Windows PowerShell:

Select-String ` -Path app\google-services.json ` -Pattern '"current_key"'

Inspect the Generated google_api_key Resource

After processing the JSON, the Google Services Gradle plugin generates:

google_api_key

under a path similar to:

app/build/generated/res/google-services/ debug/values/values.xml

If the JSON was replaced but the build appears to use an older resource, clean and rebuild.

Solution 14: Sync, Clean, and Rebuild

macOS or Linux:

./gradlew clean ./gradlew assembleDebug

Windows:

gradlew.bat clean gradlew.bat assembleDebug

Android Studio:

File → Sync Project with Gradle Files

Should You Remove All API Key Restrictions?

Not as a permanent production fix.

Google currently applies Firebase-related API restrictions automatically to Firebase-provisioned keys and recommends maintaining appropriate restrictions. :contentReference[oaicite:38]{index=38}

Firebase also notes that since May 2024, Firebase-provisioned keys have been automatically restricted to relevant Firebase APIs. :contentReference[oaicite:39]{index=39}

API_KEY_SERVICE_BLOCKED vs API key not valid

API key not valid → The key itself or its app/project match is invalid

API_KEY_SERVICE_BLOCKED
→ The key exists,
but restrictions block the requested API

Firebase specifically recommends inspecting the API restrictions allowlist for API_KEY_SERVICE_BLOCKED and Forbidden 403 errors. :contentReference[oaicite:40]{index=40}

API Key Error vs Firebase Security Rules Error

A Firestore error such as:

PERMISSION_DENIED

usually points to Authentication or Security Rules rather than an invalid API key.

API key not valid → API key configuration problem

PERMISSION_DENIED
→ Security Rules / authentication problem

Be Careful When Rotating an API Key

If a released application still contains an old Firebase API key, deleting that key immediately can break Firebase requests from users who have not yet updated the app.

Fastest Troubleshooting Order

1. Download a fresh google-services.json from Firebase Console.
2. Replace the file in the application module.
3. Verify the application ID and Firebase Android package name.
4. Check the JSON project_id.
5. Verify that the API key still exists in Google Cloud Console.
6. Check Application Restrictions.
7. Check API Restrictions.
8. Verify Debug, Release, and flavor-specific configurations.
9. Run Gradle Sync.
10. Run ./gradlew clean assembleDebug.

If the Error Still Occurs

Check all of the following:

• The latest google-services.json is being used.
• The JSON was downloaded from the correct Firebase project.
• The API key and project ID belong to the same project.
• The API key was not deleted in Google Cloud Console.
• Application Restrictions match the current Android application.
• The package restriction matches the final application ID.
• Debug application ID suffixes are accounted for.
• Each product flavor uses the correct Firebase configuration.
• Required Firebase APIs have not been removed from API restrictions.
• The JSON was not manually edited.
• CI/CD is not restoring an outdated configuration.
• The Firebase key is not being unnecessarily shared with unrelated Google APIs.
• The generated google_api_key resource was rebuilt.

Summary

Firebase “API key not valid” means that the API key being sent by the Android application is not valid for the Firebase project, application, or configuration being used.

Google’s Firebase documentation lists common causes including:

Incorrect Application Restrictions

Incorrect API Restrictions

Deleted API key

API key from a different project

:contentReference[oaicite:41]{index=41}

The safest first fix is to download an updated:

google-services.json

from Firebase Console and replace the file in the Android application module. Firebase checks for API keys that match the app when producing its Firebase configuration. :contentReference[oaicite:42]{index=42}

Then inspect:

Google Cloud Console → APIs & Services → Credentials

and verify that the key exists and that its Application Restrictions and API Restrictions are appropriate.

Finally, remember that a Firebase API key is primarily an identifier, not the security boundary for your Firebase data. Google’s current guidance is to secure Firebase data with Security Rules and supported services with App Check rather than attempting to treat the Firebase API key as a secret authorization credential. :contentReference[oaicite:43]{index=43}