Skip to content

Conversation

@google-labs-jules
Copy link
Contributor

@google-labs-jules google-labs-jules bot commented Nov 19, 2025

Added the x-ios-bundle-identifier header to GenerativeAIService and LiveSessionService requests to support iOS application API key restrictions. This requires callers to set the x-ios-bundle-identifier header to match one of the iOS Bundle IDs specified for the API key. This addresses #15475.

Important: We still strongly recommend the use of Firebase AppCheck instead of, or in addition to, API key restrictions.

This change adds the `x-ios-bundle-identifier` header to requests made by `GenerativeAIService`. The value is set to `Bundle.main.bundleIdentifier` if available. This header is sent unconditionally.

A test assertion has been added to `GenerativeModelTestUtil.swift` to verify the presence and correctness of this header in unit tests.
@andrewheard andrewheard changed the title Add x-ios-bundle-identifier header to GenerativeAIService [Firebase AI] Add x-ios-bundle-identifier header to requests Nov 21, 2025
@firebase firebase deleted a comment from google-labs-jules bot Nov 21, 2025
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request correctly adds the x-ios-bundle-identifier header to support API key restrictions for iOS applications. The changes are applied to GenerativeAIService and LiveSessionService, and the unit tests have been updated accordingly. I've identified a small code duplication in GenerativeAIService.swift and a minor inconsistency in LiveSessionService.swift. Addressing these points will improve the code's clarity and maintainability.

@andrewheard
Copy link
Contributor

Verified locally that requests missing the header produce API_KEY_IOS_APP_BLOCKED without the header and this fixes the error.

Full Response
{
  "error": {
    "code": 403,
    "message": "Requests from this iOS client application com.google.firebase.FirebaseAITestApp are blocked.",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "API_KEY_IOS_APP_BLOCKED",
        "domain": "googleapis.com",
        "metadata": {
          "iosBundleId": "com.google.firebase.FirebaseAITestApp",
          "consumer": "projects/{project_number}",
          "service": "firebasevertexai.googleapis.com"
        }
      },
      {
        "@type": "type.googleapis.com/google.rpc.LocalizedMessage",
        "locale": "en-US",
        "message": "Requests from this iOS client application com.google.firebase.FirebaseAITestApp are blocked."
      }
    ]
  }
}

@google-labs-jules
Copy link
Contributor Author

Verified locally that requests missing the header produce API_KEY_IOS_APP_BLOCKED without the header and this fixes the error.

Full Response
{
  "error": {
    "code": 403,
    "message": "Requests from this iOS client application com.google.firebase.FirebaseAITestApp are blocked.",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "API_KEY_IOS_APP_BLOCKED",
        "domain": "googleapis.com",
        "metadata": {
          "iosBundleId": "com.google.firebase.FirebaseAITestApp",
          "consumer": "projects/{project_number}",
          "service": "firebasevertexai.googleapis.com"
        }
      },
      {
        "@type": "type.googleapis.com/google.rpc.LocalizedMessage",
        "locale": "en-US",
        "message": "Requests from this iOS client application com.google.firebase.FirebaseAITestApp are blocked."
      }
    ]
  }
}

Thanks for verifying!

@andrewheard andrewheard added this to the 12.7.0 - M174 milestone Nov 21, 2025
@andrewheard andrewheard marked this pull request as ready for review November 21, 2025 22:16
@andrewheard andrewheard merged commit cc8f4aa into main Nov 21, 2025
65 checks passed
@andrewheard andrewheard deleted the feature-add-bundle-id-header branch November 21, 2025 22:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants