What is the difference between Firebase API key (a.k.a Server Key) and the Web API Key?

Question

In Firebase console under Project Settings/General beneath the Project ID field there is a Web API key :

Where is this used? I know that the Server key found under Project Settings/Cloud Messaging is used as Authorization key to make calls to the firebase console:

I have also noticed that in google-services.json ther is an "api_key" property that has a "current_key" value which is different from both keys that I have mentioned. What is that key?

Answer 1

From my answer here:

• current key - nothing is explicitly stated anywhere in the docs where it is used, however, among the 3 services where the google-services.json was originally used for before Firebase (Google Sign-in, Analytics, GCM), I'm guessing it would be between Google Sign-in and Analytics. As also mentioned by @DiegoGiorgini here:

The api_key value in google-services.json is not used by FCM. (it is used by other Firebase libraries)

So it can be for a separate Google non-Firebase or Firebase service.

• Web API Key - this one I haven't had a chance to use before. However, I've seen other posts wherein this specific API key is used often on Web apps related to Firebase (possibly also for Auth purposes?), but I'm not entirely sure.

• Server Key - as per the docs:

A server key that authorizes your app server for access to Google services, including sending messages via Firebase Cloud Messaging.

Answer 2

• current_key (as per the docs) is the Android key auto-created by Firebase when creating a Firebase Android App. It's NOT used to control access to backend resources. Instead, it's used to identify your Firebase project when interacting with Firebase/Google services. Specifically, it's used to associate API requests with your project for quota and billing.

• Web API Key (as per the docs): can be used to authenticate users by passing its value to the key query parameter in several API endpoints, e.g., sign up or sign in using email & password, generate refresh token, etc.

• Server Key (as per the docs): is a server key that authorizes your app server for access to Google services, including sending messages via the Firebase Cloud Messaging legacy protocols.