€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs (discuss.ai.google.dev)

Article summary

A company experienced an unexpected €54,000 billing spike in 13 hours after enabling Firebase AI Logic on an existing Firebase project, due to an unrestricted Firebase browser key being used for Gemini API requests. The company had a budget alert and a cost anomaly alert, but the costs were already high by the time they reacted. The charges were classified as valid usage by Google Cloud support, and the request for a billing adjustment was denied. The company is seeking guidance on safeguards beyond App Check, quotas, and moving calls server-side.

Main themes

• Unexpected billing spikes
• Firebase and Gemini API integration
• API key security
• Cloud billing and cost management
• Developer safeguards and best practices

What commenters say

• The lack of real-time billing and spend limits in cloud providers can lead to unexpected and extreme costs, highlighting the need for better cost management tools.
• Prepaid billing models can help limit liability, but may not be suitable for all use cases, such as viral traffic or steady growth.
• API keys should be treated as secrets, and developers should take responsibility for securing them, rather than relying on cloud providers to prevent abuse.
• Cloud providers should offer more robust safeguards, such as hard spend limits and real-time billing, to prevent unexpected costs and protect developers from financial losses.
• The current system of notifications and soft caps is insufficient, and developers need more control over their spending to avoid unexpected bills.
• The use of API keys is outdated and should be replaced with more secure and modern authentication methods, such as real-time crypto payments.
• The introduction of prepaid billing models and hard spend limits could help prevent unexpected costs, but may also introduce new challenges, such as downtime and complaints.