Firebase Functions Environment Config — Managing Secrets and Environment Variables

In this tutorial, you will learn about Firebase Functions Environment Config. We cover key concepts, practical examples, and best practices to help you master this topic.

Firebase Functions environment Configuration Management stores environment variables and secrets for Cloud Functions, supporting different configurations for development, staging, and production environments.

What You'll Learn

• Setting environment variables with firebase functions:config
• Using Google Cloud Secret Manager
• Managing multiple environment configurations

Why It Matters

Hardcoded secrets and API keys are a security risk. Firebase Functions config provides secure, environment-specific configuration management. DodaTech stores all API keys, database URLs, and service credentials in Firebase Functions config and Secret Manager.

Code Examples

# Set configuration variables
firebase functions:config:set \
  stripe.secret="sk_live_..." \
  stripe.webhook_secret="whsec_..." \
  sendgrid.api_key="SG.xxxxx" \
  app.environment="production" \
  app.log_level="info"

# View current config
firebase functions:config:get

# Use for specific environment
firebase functions:config:set \
  --project staging \
  app.environment="staging"

# Remove a config key
firebase functions:config:unset stripe.secret

// Access config in Cloud Functions
const functions = require('firebase-functions');

// Read config values
const stripeSecret = functions.config().stripe.secret;
const sendgridKey = functions.config().sendgrid.api_key;
const environment = functions.config().app.environment;

// Use in function
exports.processPayment = functions.https.onCall(async (data, context) => {
  const stripe = require('stripe')(functions.config().stripe.secret);

  const paymentIntent = await stripe.paymentIntents.create({
    amount: data.amount,
    currency: 'usd',
  });

  return { clientSecret: paymentIntent.client_secret };
});

// Using Google Cloud Secret Manager (recommended for secrets)
const { SecretManagerServiceClient } = require('@google-cloud/secret-manager');

const secrets = new SecretManagerServiceClient();

async function accessSecret(secretName) {
  const [version] = await secrets.accessSecretVersion({
    name: `projects/${process.env.GCLOUD_PROJECT}/secrets/${secretName}/versions/latest`
  });
  return version.payload.data.toString();
}

exports.processWithSecret = functions.https.onCall(async (data, context) => {
  const apiKey = await accessSecret('MY_API_KEY');
  // Use the secret
});

// Environment switching
const config = {
  development: {
    apiUrl: 'http://localhost:3000',
    logLevel: 'debug'
  },
  staging: {
    apiUrl: 'https://staging-api.example.com',
    logLevel: 'info'
  },
  production: {
    apiUrl: 'https://api.example.com',
    logLevel: 'error'
  }
};

const env = functions.config().app.environment || 'development';
const appConfig = config[env];

# Deploy with config
firebase deploy --only functions

# Config is deployed with the functions
# You must redeploy functions after changing config

Common Mistakes

1. Storing Secrets in Code

Never commit API keys or passwords to source control. Use functions:config or Secret Manager.

2. Forgetting to Set Config Before Deploy

Functions may fail at runtime if they reference config values that are not set.

3. Not Using Different Configs for Different Environments

Use firebase use --add and set different config values per project.

4. Exposing Config Values in Logs

Do not log config values. They may contain sensitive information.

5. Using functions.config() for Non-Secret Values

Use regular environment variables for non-sensitive values to simplify management.

Practice Questions

1. How do you set a configuration value?
2. How do you access config values in a function?
3. What is the recommended way to store secrets?
4. How do you manage different configs for dev and prod?
5. What happens if you reference a missing config value?

Answers:

1. firebase functions:config:set key.value="value".
2. functions.config().key.value.
3. Google Cloud Secret Manager.
4. Use different Firebase projects with different config values per project.
5. The function throws an error at runtime.

Challenge: Set up a Cloud Functions project with environment-specific configuration for development, staging, and production. Use Secret Manager for sensitive values and functions:config for environment-specific settings.

FAQ

Mini Project

Set up a Cloud Functions project with secrets management. Configure development, staging, and production environments with different API keys. Implement a function that uses Secret Manager for database credentials and functions:config for environment settings.

What's Next

Learn about Firebase Hosting rewrites for serving dynamic content, then explore Cloud Messaging for push notifications.