title: Is it safe to expose Firebase apiKey to the public?
body: <p>The <a href="https://firebase.google.com/docs/web/setup#add_firebase_to_your_app" rel="noreferrer">Firebase Web-App guide</a> states I should put the given <code>apiKey</code> in my Html to initialize Firebase:</p>
  <pre class="lang-html prettyprint-override"><code>// TODO: Replace with your project's customized code snippet
  &lt;script src=&quot;https://www.gstatic.com/firebasejs/3.0.2/firebase.js&quot;&gt;&lt;/script&gt;
  &lt;script&gt;
    // Initialize Firebase
    var config = {
      apiKey: '&lt;your-api-key&gt;',
      authDomain: '&lt;your-auth-domain&gt;',
      databaseURL: '&lt;your-database-url&gt;',
      storageBucket: '&lt;your-storage-bucket&gt;'
    };
    firebase.initializeApp(config);
  &lt;/script&gt;
  </code></pre>
  <p>By doing so, the <code>apiKey</code> is exposed to every visitor.</p>
  <p>What is the <strong>purpose of that key</strong> and is it really <strong>meant to be public</strong>?</p>