is it ok to exposed the firebase config to the client?

[jozhuare99]

is it fine to be exposed the config?

[JEROME-PRAKASH-L]

Yes—the Firebase web config object is designed to be included in client code. Firebase documents its values (including the Firebase-provisioned API key, project ID, app ID, database URL, and storage bucket) as non-secret identifiers.

That does not mean the backend is automatically public. Protect it with:

• Firebase Security Rules for Firestore, Realtime Database, and Storage
• Firebase Authentication where access should be user-specific
• App Check where supported
• API-key restrictions limited to the Firebase APIs and app origins you actually use

Do not put genuinely privileged credentials in client code: service-account private keys, FCM server keys, Admin SDK credentials, or API keys for unrelated services such as the Gemini Developer API.

Official references: Firebase config object, API keys for Firebase, and the Firebase security checklist.