Unexpected Firebase charges? How to find what's billing you

The investigation can wait an hour. A runaway can't. If the charge is growing right now, cut it at the source: disable the API that's spiking, restrict or delete the key it's called with, or lower the API's quota. As a last resort, disconnect billing from the project, after reading what happens when billing stops.

Billing data arrives late. In Google's words: "Typically, your cost details are available within a day, but can sometimes take more than 24 hours." And: "These system delays also impact budget alerts, anomaly detection, and billing data exported to BigQuery." (Cloud Billing reports). So today's report mostly shows yesterday. For anything recent, the usage metrics in Cloud Monitoring are much closer to real time.

1. Open the report. In the Google Cloud console, go to Billing, pick the billing account and open Reports. By default it shows this month's daily cost, grouped by service.
2. Widen the time range. Set it to the last 30 or 90 days, so the jump stands out against normal days.
3. Group by project. If the billing account pays for several projects, find the one that changed, then filter to it.
4. Group by service. Cloud Firestore, Cloud Functions, Cloud Run, the Gemini API: one of them will have grown.
5. Group by SKU. A SKU is the exact thing you pay for, such as Firestore reads, Cloud Run CPU time or internet egress. This line tells you what to look for.
6. Find the day. The chart shows cost per day. The first day the SKU jumped is where to look for a deploy, a traffic spike or an attack.

The reports stop at days. For the hour, open the matching usage metric in Cloud Monitoring's Metrics Explorer: document reads for Firestore, executions for Cloud Functions, request count for Cloud Run or for the API you're looking at. If you export billing data to BigQuery, each row also records the hour its usage started.

• Firestore reads. A query without a limit, a listener that keeps subscribing, or someone reading your data from outside: how to find what's reading your Firestore.
• Gemini or other AI APIs. Almost always a key that could call them: how to restrict a Firebase API key.
• Cloud Functions or Cloud Run. A loop, a function that triggers itself, or traffic that scaled up your instances. Cap them: how to limit Firebase spending.
• Egress or Storage downloads. Large files downloaded far more than expected, from your app or from someone linking to them.
• Phone authentication. Billed per SMS. A sudden rise often means bots requesting codes.

Open a case with Cloud Billing support and explain what happened, with dates and what you've changed since. Outcomes vary. In our horror stories, Google waived one bill as a one-time gesture, a startup grant paid another, and in others the charges stood. It costs nothing to ask.

A budget only sends an email, hours late (why budget alerts don't stop your bill). What stops the next one is a limit that acts: restricted keys, quotas, capped instances, and an automatic action when spend or usage jumps. FireShield adds that last part: it watches each service's usage every few minutes and can degrade or cut a project before the next invoice.