What Google Cloud APIs should I open access for authentication, Firebase real-time database service and Speech to text API

Question

I am trying to secure my Android application. It uses authentication provided by Google Firebase, I also store some information using Firebase Real-time database, and finally, the main functionality of the app relies on Speech-to-Text API provided also by Google.

I believe all these, can be restricted to one application (package name and app signature).

I have been playing the classic exclusion experiment, by enabling then disabling one API at a time, I couldn't find the right combination, nor any hint, any restriction yields a complete "UNAUTHORIZED" access.

The only option running now is not to restrict at all.

For what I tried already:

1. Firebase real-time database management API (enabled and disabled)
2. Cloud pub/sub API (I remember I saw this somewhere talking about Speech to text or Firebase but I am not sure!!)
3. Firebase management and Firebase installation APIs

Always with

• Cloud speech-to-text API

Without any restriction at all, all works great, Authentication/database and speech-to-text; The project connects well with the only first App level connection by providing package name and application signature hash.

Answer 1

I find solution myself, banal canonical approach:

1. Set no restrictions at all except the first level (installation step) app package name and signature in Firebase.
2. Run your application and try all functionalities as a normal user.
3. Wait for statistics to be gathered and open this tab https://console.cloud.google.com/apis/dashboard?project=##PROJECTNAMEHERE##&show=all
4. Set the right APIs to restrict for your Android/Web application.

Example

5. Wait for more than 5 minutes, then test again. If it does not work come here x)