> Canonical URL: https://codingcat.dev/post/firebase-2025-05-more-ways-to-deploy-app-hosting

# More ways to deploy with Firebase App Hosting: Web Architecture & Implementation Guide

![CodingCat.dev tutorial cover image](https://cdn.sanity.io/images/hfh83o0w/production/4de40cb32bd571d1a66f4a7f12654a9125f68fcb-1200x630.svg?w=1200&q=82&fit=max&auto=format)[![Alex Patterson](https://cdn.sanity.io/images/hfh83o0w/production/a606dfaa381aab08ddbe16a33fe1d3e1fb37c927-400x400.jpg?w=96&h=96&q=82&fit=max&auto=format)Alex Patterson](/author/alex-patterson)May 21, 2025

Calling frontier multimodal models directly from a web or mobile client is a security minefield if you expose raw API keys or hardcode brittle system prompts in your frontend bundle. Following the announcement of **More ways to deploy with Firebase App Hosting**  by Julia Reid, Eric Gilmore on the [**Official Firebase Blog**](https://firebase.blog/posts/2025/05/more-ways-to-deploy-app-hosting/) (2025-05-20), here is our hands-on CodingCat.dev breakdown of what actually shipped, how it works under the hood, and how we wire it into production TypeScript, Next.js, Astro, SvelteKit, React, and Angular applications. App Hosting has more ways to deploy to fit your team’s development workflow, and supports automatic emulator configuration to make it easier to test your web app locally.

## The Mental Model: Why More ways to deploy with Firebase App Hosting Matters for Web Devs

As a Google Developer Expert (GDE) for Firebase and Senior Solutions Engineer at CodingCat.dev, I evaluate every Firebase update through one lens: does it reduce boilerplate while keeping our runtime security and cloud bills predictable? Firebase AI Logic lets you invoke Gemini and Imagen models from client and edge apps using the Firebase Web SDK while keeping your API credentials off the wire, enforcing Firebase App Check, and managing server-side prompt templates centrally.

> AJ Pro-Tip from Alex: Combine Firebase AI Logic with server prompt templates, Firebase Remote Config feature flags, and project spend caps so you can iterate on prompts or swap Gemini models instantly without redeploying your Next.js or Astro frontend.

## How It Works: Technical Breakdown & Implementation

Previously, the Firebase team launched Firebase App Hosting into General Availability (GA), a milestone that included [**new features**](https://firebase.blog/posts/2025/04/apphosting-general-availability) to help you build faster and scale, and signalled that App Hosting is fully supported for production use.

We’re constantly improving App Hosting to make it easier for developers to build and deploy modern web apps. Since launching General Availability last month, The Firebase team added the ability to upload source code and container images directly to App Hosting (without using GitHub), giving you more flexibility in how you deploy to production. We also now have automatic configuration for the Firebase SDK in the emulator, so that when you run your app locally, it automatically uses emulated Firebase services instead of production.

### More ways to deploy

Previously, the only way to deploy to App Hosting was through GitHub: you connect App Hosting to your GitHub repo and rollouts happen automatically when changes are pushed/merged into your live branch (such as main). While CI/CD is generally considered best practice, there are reasons you may not want to use App Hosting’s built-in Git integration. For example, you might want to integrate App Hosting deployments into your own custom CI/CD pipeline. Or maybe you’re early in your app development and haven’t yet set up continuous integration.

We now have three ways to deploy to App Hosting without using GitHub: Firebase Studio (launched at Cloud Next), `firebase deploy` with the Firebase CLI, and Terraform.

If you create an app with Firebase Studio’s App Prototyping agent, you can deploy to Firebase App Hosting from Firebase Studio. This means you can upload source code directly from your workspace editor. If you have not already set up App Hosting, Firebase Studio walks you through a workflow to complete all the essential onboarding steps, from linking a Cloud Billing account to kicking off the first rollout of the app.

After deploying your app, App Hosting provides built-in monitoring within Firebase Studio, allowing you to easily check your app’s traffic and health without leaving your workspace.

The CLI command `firebase deploy` lets you push your app’s source code and configurations directly from your local machine to Firebase. This is especially convenient if you have other Firebase deployments (such as security rules or functions) and want to deploy your web app and backend services together with a single CLI command.

Your first step is to run `firebase init apphosting` in your local project directory. This command walks you through setting up local source deployments for an App Hosting backend, either an existing backend or a new one.

After initializing App Hosting, you’ll notice a new firebase.json file in your project. This file contains the information App Hosting needs to deploy your app with `firebase deploy`:

- `backendId`: the backend to deploy to
- `rootDir`: the root directory of your app
- `ignore`: any files to ignore in the build

Then, run `firebase deploy` to upload your app’s source code and configuration files to App Hosting.

App Hosting uploads your source code to a Google Cloud Storage bucket, runs your framework build command in Cloud Build, and deploys the final artifacts to Cloud Run and Cloud CDN.

For even greater control over App Hosting deployments, Terraform provides a powerful ‘infrastructure-as-code’ solution. It allows you to define and manage your App Hosting resources using declarative configuration files. A key advantage of using Terraform is the ability to deploy your own pre-built container image directly to App Hosting, instead of relying on App Hosting to build from your source code. Key advantages of building your own container image include:

- You have full control over the build process and deployed environment, including each image layer and all your app’s dependencies
- Faster rollouts, because you’re doing the build before rolling out to App Hosting

Here’s an example of the [**google_firebase_app_hosting_build**](https://registry.terraform.io/providers/hashicorp/google-beta/latest/docs/resources/firebase_app_hosting_build) and [**google_firebase_app_hosting_backend**](https://registry.terraform.io/providers/hashicorp/google-beta/latest/docs/resources/firebase_app_hosting_backend) resources:

```
resource
    project
    location
    backend
    build_id

    source
        container
            image
        }
    }
}

resource
    project
    # Choose the region closest to your users

    location
    backend_id
    app_id
    serving_locality
    service_account

    depends_on
}
```

Visit [**Get started with Terraform and Firebase**](https://firebase.google.com/docs/projects/terraform/get-started) to learn more.

### Automatic emulator configuration

Along with new ways to deploy, Firebase is introducing improvements to help you better test your app. If you are using the Firebase JavaScript SDK’s [**initializeApp without arguments**](https://firebase.google.com/docs/app-hosting/firebase-sdks#automatically-initialize-firebase-admin-and-web-sdks) to connect to Firebase services in your app (such as Auth or Realtime Database) and using the Firebase Local Emulator Suite to run your app locally, **the App Hosting emulator now automatically uses the emulated versions of those services ** instead of production. This means you can safely test locally with peace of mind that you aren’t messing with production data.

```
// Use App Hosting's automatic initialization feature
const

// Automatically connects to emulator locally,
// or to your production db when deployed to App Hosting.
const
```

## Production Web Architecture & Security Checklist

Whether we are deploying on [**Firebase App Hosting**](https://firebase.google.com/docs/app-hosting), Cloudflare Workers, or Vercel, shipping AI features to production requires defense-in-depth across three layers:

- **Enforce Firebase App Check & Attestation: ** Protect your web endpoints, Cloud Functions, Data Connect GraphQL resolvers, and Firebase AI Logic calls against unauthorized replay or billing abuse using [**Firebase App Check with reCAPTCHA Enterprise**](https://firebase.google.com/docs/app-check).
- **Validate Locally with the Firebase Emulator Suite: ** Run deterministic integration tests against local Firestore, Auth, Functions, and Data Connect PostgreSQL emulators before promoting schema or rule changes to production.
- **Keep Server & Client Boundaries Type-Safe: ** Use the modular Firebase Web SDK and generated TypeScript bindings so SSR frameworks like Next.js, Astro, SvelteKit, and Angular serialize state cleanly without hydration flickers.

## Conclusion

Accelerate your full-stack web and AI development by pairing **More ways to deploy with Firebase App Hosting**  with strict Security Rules, Firebase App Check, and local emulator testing. Come tell us on [**X (@CodingCatDev)**](https://x.com/CodingCatDev) and [**LinkedIn (CodingCat.dev)**](https://www.linkedin.com/company/codingcatdev) how you are using Firebase in your stack, and subscribe to the [**CodingCat.dev YouTube Channel**](https://www.youtube.com/@CodingCatDev?sub_confirmation=1) so you don't miss what we build next!

## Watch Our Related Firebase Video Tutorial on YouTube

Want to see how we architect and debug Firebase web applications live? Watch our related CodingCat.dev session [**Firebase Security Rules: Effortless control over your app's data.**](https://youtu.be/wGbEM0CXMuI) below, and make sure to [**Subscribe to CodingCat.dev on YouTube**](https://www.youtube.com/@CodingCatDev?sub_confirmation=1) for weekly full-stack web and AI deep dives:

## Resources, Official Docs & Related CodingCat.dev Guides

- **Primary Release Source: ** [More ways to deploy with Firebase App Hosting on the Official Firebase Blog](https://firebase.blog/posts/2025/05/more-ways-to-deploy-app-hosting/) (published 2025-05-20 by Julia Reid, Eric Gilmore)
- **Official Firebase Documentation: ** [Firebase Developer Docs & Web SDK Reference](https://firebase.google.com/docs/web/setup)
- **Related on CodingCat.dev: [Firebase MCP Server](/post/firebase-2025-05-firebase-mcp-server)**
- **Related on CodingCat.dev: [Top Firebase Studio updates from Google I/O 2025](/post/firebase-2025-05-studio-updates-from-io)**
- **Related on CodingCat.dev: [Firebase SQL with Data Connect](/podcast/firebase-sql-with-data-connect)**
- **Related on CodingCat.dev: [Build a Custom No-Code App in 90 Minutes](/podcast/build-a-custom-no-code-app-in-90-minutes)**

## Frequently Asked Questions (FAQ)

### What are the key capabilities introduced in More ways to deploy with Firebase App Hosting?

More ways to deploy with Firebase App Hosting (announced 2025-05-20 by the Firebase team) enhances the platform for Firebase, Google Cloud, Web Dev, AI, Next.js, TypeScript, Security, Serverless workloads. App Hosting has more ways to deploy to fit your team’s development workflow, and supports automatic emulator configuration to make it easier to test your web app locally. Developers can review the primary announcement on the [**Firebase Blog**](https://firebase.blog/posts/2025/05/more-ways-to-deploy-app-hosting/) alongside our implementation patterns and production checklist above.

### How do web developers use More ways to deploy with Firebase App Hosting with Next.js, SvelteKit, React, or Angular?

Web developers can integrate these features using the modular Firebase JavaScript/TypeScript SDK, Firebase Data Connect web bindings, and [**Firebase App Hosting**](https://firebase.google.com/docs/app-hosting). Always pair client-side SDK initialization with Firebase App Check and strict Security Rules, and test locally with the Firebase Local Emulator Suite before deploying.

### Where can I watch video tutorials on Firebase Web and AI development?

You can watch our hands-on Firebase video walkthroughs on the [**CodingCat.dev YouTube Channel**](https://www.youtube.com/@CodingCatDev?sub_confirmation=1), including [**Firebase Security Rules: Effortless control over your app's data.**](https://youtu.be/wGbEM0CXMuI), and follow us on [**X (@CodingCatDev)**](https://x.com/CodingCatDev) for weekly full-stack tutorials.

## Recent Posts

[View More](/blog/page/1)[![PHP2Shell (CVE-2026-109618): How AI Found a Decade-Old Bug in 70% of the Web](https://cdn.sanity.io/images/hfh83o0w/production/e83065d0a4e2f841ce64d3f4aea8ddbbf07e5cb9-1376x768.jpg?w=1376&q=82&fit=max&auto=format)](/post/php2shell-cve-2026-109618-ai-php-security-scramble)

### [PHP2Shell (CVE-2026-109618): How AI Found a Decade-Old Bug in 70% of the Web](/post/php2shell-cve-2026-109618-ai-php-security-scramble)

October 22, 2026

Two critical pre-authentication RCE flaws in PHP (CVE-2026-109618 and CVE-2026-109619), uncovered by AI models from OpenAI and Google Gemini, sparked a global patching scramble across 70% of the web. Here is how PHP2Shell works and how to patch your servers.

[![Alex Patterson](https://cdn.sanity.io/images/hfh83o0w/production/a606dfaa381aab08ddbe16a33fe1d3e1fb37c927-400x400.jpg?w=96&h=96&q=82&fit=max&auto=format)Alex Patterson](/author/alex-patterson)[![Sanity Knowledge Bases](https://cdn.sanity.io/images/hfh83o0w/production/38b0f021c51d97043c8a1ebf31d505a0ea877b7c-2752x1536.jpg?w=1920&q=82&fit=max&auto=format)](/post/sanity-knowledge-bases)

### [Sanity Knowledge Bases](/post/sanity-knowledge-bases)

October 17, 2026

Eliminate query-time guessing in your AI agents. Learn how Sanity Context Knowledge Bases compile structured datasets, crawled documentation websites, and uploaded files ahead of time, resolve conflicting facts, and serve a compact outline over Context MCP.

[![Alex Patterson](https://cdn.sanity.io/images/hfh83o0w/production/a606dfaa381aab08ddbe16a33fe1d3e1fb37c927-400x400.jpg?w=96&h=96&q=82&fit=max&auto=format)Alex Patterson](/author/alex-patterson)