Firebase Cloud Functions: Requests from referer <empty> are blocked. - PERMISSION_DENIED

Question

I am not sure why the following code is throwing google api key permission denied. I have the api or service enabled both in firebase console and google console.

export async function createJobDynamicLink(job){
    if(job.jobStatus !== 'approved' ||  (job.dynamicLink).length > 2){
        console.log('Dynamic link already exist!');
        return false;
    }

    console.log(dynamic_links);
    console.log(dynamic_links_key);
    // Firebase web api key logs just fine
    const options = {
        method: 'POST',
        uri: `https://firebasedynamiclinks.googleapis.com/v1/shortLinks?key=${dynamic_links_key}`,
        body: {
            "longDynamicLink": makeDynamicLongLink(job)
        },
        json: true
    };

    return await requestpromise(options)
        .then(function (parsedBody) {
            console.log(parsedBody);
            return parsedBody.shortLink;
        })
        .then((shortLink) => {
            //post.shareUrl = shortLink;
            console.log('short link: ' + shortLink);
            //return event.data.ref.set(post);
            return shortLink;
        })
}
export async function makeDynamicLongLink(job) {
    return buildUrl(`${dynamic_links}`, {
        queryParams: {
            link: `https://app.com/jobs/${slugify(job.jobTitle)}-${job.id}`,
            apn: "com.app.appe",
            ibi: "com.app.app",
            dfl: "https://app.com",
            st: job.jobTitle,
        }
    });
}

Is something wrong with the way I am doing the request using request-promise?

StatusCodeError: 403 - {
  "error": {
    "code": 403,
    "message": "Requests from referer <empty> are blocked.",
    "status": "PERMISSION_DENIED",
    "details": [{
      "@type": "type.googleapis.com/google.rpc.Help",
      "links": [{
        "description":"Google developer console API key",
        "url": "https://console.developers.google.com/project/904573jjwj/apiui/credential"
      }]
    }]
  }
}

Answer 1

Go to the Google API Credentials https://console.developers.google.com/apis/credentials and see if there is any restriction on your API Key you're using. If it is restricted by HTTP referrers, then add your website domain to it and add the Referrer header like the above answer. Although in your use case, None or IP address restriction is a better choice.