Locking down Firebase DB access to specific apps

I have found a solution that maybe helps you or anyone that have a similar question. I answered it in this question:

Restricting Cloud Firestore to a specific domain

There is no way to limit access to your database to just your app. That just doesn't match with the cloud-based nature of the Firebase APIs. Anyone that knows the URL of your database can in in principle access it, and security rule are the way to ensure all access is authorized.

Note that security rules are not an all-or-nothing approach: you can require sign-in for some parts of your database, while leaving other parts publicly readable. But you can't make the publicly readable parts only be readable by your own app.

Some previous questions on the same topic:

• how to make sure only my own website (clientside code) can talk to Firebase backend? (pretty much my go-to answer for this)
• How to allow only my app to access firebase without a login?
• Restrict Firebase database access to one Android app
• How to allow only my app to access firebase without a login?

Update: since May 2021 you can actually restrict access to just users of your App by implementing Firebase App Check.