Enforcing Firebase App Check on Cloud Run Endpoints Without SDK Wrappers
When deploying standalone containers on Cloud Run, you can verify incoming Firebase App Check JWTs at the Envoy ingress layer or inside Express/Fastify middleware by verifying the token against Google's public JWKS (`https://firebaseappcheck.googleapis.com/v1/jwks`).
This rejects synthetic bot ingress with `HTTP 401 Unauthorized` before your Node.js application ever instantiates a Gemini API request, saving 100 percent of token burn from unauthenticated traffic.
Atomic Firestore Token Bucket Increments Under Concurrency
To prevent client retry loops from overwhelming per-UID token allowances, do not use read-then-write transactions. Instead, use `FieldValue.increment(consumedTokens)` within a Firestore document update.
Atomic field increments execute at database speed without transaction retry contention, ensuring accurate token accounting even when an AI agent fires 50 concurrent tool calls.
Preventing Prompt Loop Quota Exhaustion with 402 HTTP Circuit Breakers
When a Google Cloud Spend Cap fuses, new API calls return a quota error. If your agent does not catch this explicitly, it can crash mid-execution and leave database state partially mutated.
Always wrap Gemini API calls in a circuit breaker that intercepts quota errors and returns a structured `HTTP 402 Payment Required` to the calling agent, allowing the client to safely checkpoint its progress.