Starting November 2, 2026, Firebase App Check enforcement will be required to use Firebase AI Logic. Learn more.

Model updates:

The latest Gemini models, like Gemini 3.8 Flash, are available to use with Firebase AI Logic! Learn more.
Gemini 2.5 models will shut down in October 2026. To avoid service disruptions, update to a newer model (like gemini-3.8-flash or gemini-3.1-flash-image). Any stable Gemini Live API 2.5 models are not impacted. Learn more.

Restrict requests to only authenticated users

You can enforce authenticated-users mode for your Firebase project. When enforced, all Gemini API requests via Firebase AI Logic must come from authenticated users of your app. Specifically, the end user of your app must be authenticated using Firebase Authentication before they send a request to Firebase AI Logic from your app. If the end user is unauthenticated, the request is blocked.

When a request is blocked, the response will be a 401: unauthenticated error.

Important considerations

Be aware of the following important considerations for authenticated-users mode.

When authenticated-users mode is enforced

When authenticated-users mode is enforced, be aware of the following:

This setting is a project-wide setting for Firebase AI Logic.
- It applies to all apps registered in the project.
- It only applies to the project where it's enforced.
This setting blocks all requests via Firebase AI Logic that do not send Firebase Authentication credentials.
- The user must be authenticated via Firebase Authentication before sending the request to Firebase AI Logic.
- This setting applies to all requests via Firebase AI Logic to both the Gemini Developer API and the Agent Platform Gemini API (formerly Vertex AI).
- This setting applies to all requests that use server prompt templates.
- This setting cannot be applied on a per-user, per-API, or per-template basis.
This setting does not block Gemini API requests in your project that are not via Firebase AI Logic.
If you're using hybrid / on-device:
- This setting blocks requests to the cloud-hosted model if the user is unauthenticated.
- This setting does not block requests to the on-device model no matter the authentication state of the user.
If you're using the Gemini Live API:
- This setting blocks usage of the Gemini Live API for web apps when using Firebase AI Logic — even for authenticated users. This includes web apps using the Firebase JS SDK or Flutter web apps.
If you're using the Firebase AI Logic REST API:
- This setting blocks inference requests that do not send Firebase Authentication credentials. This includes requests for server prompt templates like templateGenerateContent or templateStreamGenerateContent.
- This setting does not block control-plane requests (like those for managing templates and configurations) because they are guarded by IAM.
This setting does not block requests to countTokens (the Count Tokens API).

Before enforcing authenticated-users mode

Be aware of the following before you enforce authenticated-users mode:

If you have existing versions of your app that do not use Firebase Authentication:
- This setting will block requests via Firebase AI Logic from those existing app versions.
- Make sure that all active clients have been updated to use Firebase Authentication before enforcing authenticated-users mode.
Older Flutter plugin versions require special instantiation to send Firebase Authentication credentials with requests.
- If your app uses the Flutter plugin firebase_ai v3.11.0 or lower (BoM v4.12.0 or lower) and does not pass in Authentication during instantiation, this setting will block requests via Firebase AI Logic — even for authenticated users.
- Make sure that all active clients for Flutter have been updated to a newer version of the plugin before enforcing authenticated-users mode.