Insights · 5 min read
Why your Firebase bill spiked, and how to keep it under control
By Austin Hunter ·
Firebase is cheap for most small apps until, one month, it isn't. We run several apps on Firebase and Google Cloud and keep budget and forecast alerts on every billed project, because surprises do happen. Here's what usually causes them and what actually limits them.
First, know what a budget does (and doesn't)
A Google Cloud budget on the Blaze plan sends alerts. On its own it doesn't stop spending. Firebase's documentation describes separate spend caps for a few services (Cloud Functions, App Hosting, Firebase AI Logic and Extensions), and anything beyond those needs either code that reacts to the alert or a person who acts on it quickly. Check Firebase's current "spend caps" and "budget alerts" pages for your project.
The usual causes
- Database reads that grow with every user: screens that listen to a whole collection, or queries without limits, so each open app re-reads thousands of documents.
- A loop: a Cloud Function that writes to the same data that triggers it, running over and over.
- An API key used for something it shouldn't be. Keys shipped in an app can be copied, and if they're allowed to call paid APIs (AI models, maps) someone else can run up your bill.
- Bots or scrapers hammering an unauthenticated endpoint.
- Storage downloads of large images with no caching or resizing.
Settings that keep it predictable
- Budget and forecast alerts on every billed project, going to someone who will act on them.
- Spend caps on the services that support them.
- API key restrictions: limit each key to the specific APIs and apps it needs.
- App Check, so only your real app can call your backend.
- Query limits, pagination and caching in the app, so a busy day doesn't multiply reads.
- A monthly look at the usage graphs, not just the invoice.
If it's happening right now
Find the service and the day the spike started in the billing reports, restrict or rotate any key that might be misused, and fix the query or function causing it. If the cause was abuse of a leaked key, contact Google Cloud billing support about the charges.
A second pair of eyes
Our $990 Production health check reviews running costs, exposed keys and data access rules on a live app and gives you a ranked fix list with fixed prices.