> Canonical URL: https://codingcat.dev/post/firebase-2026-04-cloud-next-2026-ai-logic # Ship production AI features faster with Firebase AI Logic: Web Architecture & Implementation Guide ![CodingCat.dev tutorial cover image](https://cdn.sanity.io/images/hfh83o0w/production/35176ade5d41845893cf9e9af8c57b531d58349d-1200x630.svg?w=1200&q=82&fit=max&auto=format)[![Alex Patterson](https://cdn.sanity.io/images/hfh83o0w/production/a606dfaa381aab08ddbe16a33fe1d3e1fb37c927-400x400.jpg?w=96&h=96&q=82&fit=max&auto=format)Alex Patterson](/author/alex-patterson)April 23, 2026 Calling frontier multimodal models directly from a web or mobile client is a security minefield if you expose raw API keys or hardcode brittle system prompts in your frontend bundle. Following the announcement of **Ship production AI features faster with Firebase AI Logic** by Miguel Ramos on the [**Official Firebase Blog**](https://firebase.blog/posts/2026/04/cloud-next-2026-ai-logic/) (2026-04-22), here is our hands-on CodingCat.dev breakdown of what actually shipped, how it works under the hood, and how we wire it into production TypeScript, Next.js, Astro, SvelteKit, React, and Angular applications. If you’ve been building with Firebase AI Logic, you know the core story: direct access to Gemini from your mobile or web app, with no backend to build or maintain. Thousands of apps are already running this in production today. ## The Mental Model: Why Ship production AI features faster with Firebase AI Logic Matters for Web Devs As a Google Developer Expert (GDE) for Firebase and Senior Solutions Engineer at CodingCat.dev, I evaluate every Firebase update through one lens: does it reduce boilerplate while keeping our runtime security and cloud bills predictable? Firebase AI Logic lets you invoke Gemini and Imagen models from client and edge apps using the Firebase Web SDK while keeping your API credentials off the wire, enforcing Firebase App Check, and managing server-side prompt templates centrally. > AJ Pro-Tip from Alex: Combine Firebase AI Logic with server prompt templates, Firebase Remote Config feature flags, and project spend caps so you can iterate on prompts or swap Gemini models instantly without redeploying your Next.js or Astro frontend. ## How It Works: Technical Breakdown & Implementation This blog post covers what’s new at Cloud Next ’26. We’ve been listening to your feedback and working on features that give you more control over security, prompt management, and cost optimization, all while keeping the client-first simplicity you’re used to. If you’re new to Firebase AI Logic, check out the [**getting started guide**](https://firebase.google.com/docs/ai-logic/get-started) first. For a broader overview of our client-first architecture and why it matters for mobile and web apps, take a look at our [**I/O 2025 blog post**](https://firebase.blog/posts/2025/05/building-ai-apps/). ### Server Prompt Templates: now with function calling and chat Back in December, we [**launched server prompt templates**](https://firebase.blog/posts/2025/12/server-prompt-templates-ai-logic/) to let you move your prompts off the client and onto Firebase’s servers. Many of you adopted them to protect prompt IP and speed up iteration cycles. At launch, templates supported text-and-image inputs with standard system instructions. The two most common requests we heard were: “Can I use function calling with these?” and “What about multi-turn chat?” You can now use server prompt templates to power multi-turn conversations. The system instructions, model configuration, and any tool definitions live on the server. Your client code just references the template ID and manages the conversation turn-by-turn. Here’s what a chat template looks like on the server side (you define this in the Firebase console): ``` --- model: gemini-3-flash-preview config: topK: 20 topP: 0.8 input: default: message: "" schema: message?: string --- {{history}} {{message}} ``` The `{{history}}` placeholder is the key ingredient. It tells the template where to inject the conversation turns managed by the client SDK. On the client, you provide the template ID and the parameter values. Here’s how it works in Kotlin: ``` val . // Start a chat session with your template ID val "weather-assistant-v2" mapOf ) // Send messages. The template's system instructions and // model config apply to every turn automatically val Content ) println ``` The key benefit here is that you can iterate on your system instructions, swap the underlying model, or adjust safety settings, all from the Firebase console, without pushing an app update. Your chat feature keeps working with the new configuration instantly. ### Function calling in templates You can now define tool declarations directly in your server prompt template’s frontmatter. The function schemas, like your system instructions, stay on the server and are never exposed to the client binary. Here’s what a template with function calling looks like: ``` --- model: gemini-3-flash-preview tools: - name: takePicture description: Use the device's camera to take a picture input: schema: orientation(enum, camera orientation): [PORTRAIT, LANDSCAPE] useFlash?: boolean, whether or not to use the flash zoom?: type: number description: how zoomed in the camera should be minimum: 1 maximum: 10 output: schema: aspectRatio?: string, the aspect ratio of the photo mimeType: string, mime type of the image data: string, base64 encoded image data input: schema: customerName?: string --- {{role "system"}} You are great at writing poems and always give detailed compliments about photos the user takes. {{role "user"}} {{#if customerName}} Take a picture for {{customerName}}. {{else}} Describe and compliment the picture in the history. {{/if}} {{history}} ``` Notice that the `tools` block defines the full function schema (name, description, typed parameters with constraints, and expected output) entirely on the server. Your client never sees these definitions. On the client, function calling with templates works through the chat API. You start a chat session with the template, send a message, and check whether the model returned a function call. If it did, you execute your local logic and send the result back. Here’s what the client code looks like in Dart for a Flutter app: ``` final // Start a chat session with a template that has tools defined var 'function-calling-v1' inputs ); // Send a message that might trigger a function call var Content ); // Check if the model wants to call a function final if final if // Execute your local logic final 'orientation' 'useFlash' 'zoom' }; // Send the function result back to the model var Content ); print } } ``` This is powerful because the tool schema, parameter constraints, and system instructions that guide the model’s decisions are all managed server-side in the template. Your client code only handles the execution of local actions and the conversation flow. If you need to add a new tool, tweak a parameter constraint, or change the system prompt, just update the template in the Firebase console and it’s live instantly. No app update required. For full syntax and configuration details, check out the [**updated template docs**](https://firebase.google.com/docs/ai-logic/server-prompt-templates/get-started). ### Replay attack protection from App Check Firebase AI Logic has always kept your Gemini API key on our servers, never exposed to the client. Additionally, using [**Firebase App Check**](https://firebase.google.com/docs/app-check) provides a **critical ** additional layer that validates that requests come from your legitimate, untampered app using device attestation providers like Play Integrity or DeviceCheck. When using App Check with Firebase AI Logic, we already supported [**limited-use tokens**](https://firebase.blog/posts/2025/09/firebase-ai-logic-updates/) with configurable lifespans as short as 5 minutes. Starting in May 2026, we’re **introducing replay attack protection, which makes App Check tokens strictly single-use.** Even if an attacker intercepts a valid token over the network, they cannot replay it. Each token is consumed on first use and rejected on any subsequent attempt. This is especially valuable for AI endpoints where each call has a direct cost impact on your bill. For example securing a retail AI endpoint from abuse for virtual try on. ### Type-safe automatic function calling Implementing function calling, where the model can call specified external APIs and functions from your app, used to require a lot of boilerplate: manually defining JSON schemas, parsing the model’s tool call responses, serializing parameters, and handling errors at each step. It’s the kind of code that’s tedious to write and easy to get wrong. the SDKs now support **type-safe automatic function calling**. For example, define a native Kotlin data class, and the SDK does the rest. It infers the tool schema, registers it with the model, and handles serialization and deserialization automatically. ``` // Define your parameters as a standard Kotlin data class @Serializable data val val ) // The SDK automatically infers the schema and handles the call val modelName tools Tool. params: // Your native Kotlin logic runs here gameViewModel. "Awarded } ) ) ``` No manual JSON parsing. No schema definition boilerplate. Just native data classes and lambdas. This means fewer bugs, less code to maintain, and faster feature delivery. ### Explicit context caching In many production scenarios, you’re sending the same large chunk of context (like a company policy document, a product catalog, a long video) to the model repeatedly for different users. Processing those same input tokens over and over is expensive and adds latency. [**Explicit context caching**](https://firebase.google.com/docs/ai-logic/context-caching) lets you upload that heavy context once to the Gemini API and get a cache ID back. Reference that cache ID in your server prompt template, and the model only processes the user’s short query against the pre-cached context. ``` --- model: 'gemini-3-flash-preview' config: cachedContent: 'cachedContents/your-cache-id-here' --- {{role "system"}} You are a customer service agent. Answer questions based on the company policy document provided in the cached context. {{role "user"}} {{customerQuestion}} ``` If you’re making a lot of requests to this content, then using explicit caching can reduce your input token costs significantly and makes responses feel noticeably faster. The combination with server prompt templates is particularly useful: you set the cache ID on the server, and your client code doesn’t need to know or manage anything about caching. ### Hybrid on-device inference for Android (experimental) Since October 2025, we’ve supported [**hybrid on-device inference for web apps on Chrome**](https://firebase.blog/posts/2025/10/understand-ai-logic-hybrid-inference). Now, we’re **bringing the same hybrid on-device capability to Android**. If you set the inference mode to `PREFER_ON_DEVICE`, the SDK checks if the device supports Gemini Nano. If it does, inference runs locally with less latency, absolute data privacy, and zero API cost to you. If the device doesn’t support on-device inference, the SDK seamlessly falls back to the cloud-hosted model. ``` val modelName inferenceMode ) val ``` You write one codebase. No conditional logic. No separate execution paths. The Android devices that support on-device AI are growing. By implementing this now, you improve margins and performance for a segment of your users without adding architectural complexity. This is currently experimental on Android. We’d love your feedback as we work toward a stable release, so let us know what you’re building with it. ### Start building We’d love to hear what you think. These features were shaped by community feedback, and your input directly influences what we work on next. Join us at the [**Firebase community forums**](https://firebase.google.com/community), and if you attended our Cloud Next session or watched on-demand ([**BRK2-064**](https://www.googlecloudevents.com/next-vegas/session-library?session_id=3911904&name=build-production-ready-and-hybrid-ai-apps-with-gemini-and-firebase&tab=sessions&date=all)), thank you! ## Production Web Architecture & Security Checklist Whether we are deploying on [**Firebase App Hosting**](https://firebase.google.com/docs/app-hosting), Cloudflare Workers, or Vercel, shipping AI features to production requires defense-in-depth across three layers: - **Enforce Firebase App Check & Attestation: ** Protect your web endpoints, Cloud Functions, Data Connect GraphQL resolvers, and Firebase AI Logic calls against unauthorized replay or billing abuse using [**Firebase App Check with reCAPTCHA Enterprise**](https://firebase.google.com/docs/app-check). - **Validate Locally with the Firebase Emulator Suite: ** Run deterministic integration tests against local Firestore, Auth, Functions, and Data Connect PostgreSQL emulators before promoting schema or rule changes to production. - **Keep Server & Client Boundaries Type-Safe: ** Use the modular Firebase Web SDK and generated TypeScript bindings so SSR frameworks like Next.js, Astro, SvelteKit, and Angular serialize state cleanly without hydration flickers. ## Conclusion Accelerate your full-stack web and AI development by pairing **Ship production AI features faster with Firebase AI Logic** with strict Security Rules, Firebase App Check, and local emulator testing. Come tell us on [**X (@CodingCatDev)**](https://x.com/CodingCatDev) and [**LinkedIn (CodingCat.dev)**](https://www.linkedin.com/company/codingcatdev) how you are using Firebase in your stack, and subscribe to the [**CodingCat.dev YouTube Channel**](https://www.youtube.com/@CodingCatDev?sub_confirmation=1) so you don't miss what we build next! ## Watch Our Related Firebase Video Tutorial on YouTube Want to see how we architect and debug Firebase web applications live? Watch our related CodingCat.dev session [**Firebase SQL with Data Connect**](https://youtu.be/N25khadfUag) below, and make sure to [**Subscribe to CodingCat.dev on YouTube**](https://www.youtube.com/@CodingCatDev?sub_confirmation=1) for weekly full-stack web and AI deep dives: ## Resources, Official Docs & Related CodingCat.dev Guides - **Primary Release Source: ** [Ship production AI features faster with Firebase AI Logic on the Official Firebase Blog](https://firebase.blog/posts/2026/04/cloud-next-2026-ai-logic/) (published 2026-04-22 by Miguel Ramos) - **Official Firebase Documentation: ** [Firebase Developer Docs & Web SDK Reference](https://firebase.google.com/docs/web/setup) - **Related on CodingCat.dev: [Next.js Deployment Adapters: A bright future for Next.js on Google Cloud](/post/firebase-2026-03-nextjs-adapters)** - **Related on CodingCat.dev: [What’s new from Firebase at Cloud Next 2026](/post/firebase-2026-04-cloud-next-2026-announcements)** - **Related on CodingCat.dev: [Firebase SQL with Data Connect](/podcast/firebase-sql-with-data-connect)** - **Related on CodingCat.dev: [Build a Custom No-Code App in 90 Minutes](/podcast/build-a-custom-no-code-app-in-90-minutes)** ## Frequently Asked Questions (FAQ) ### What are the key capabilities introduced in Ship production AI features faster with Firebase AI Logic? Ship production AI features faster with Firebase AI Logic (announced 2026-04-22 by the Firebase team) enhances the platform for Firebase, Google Cloud, Web Dev, AI, TypeScript, Security workloads. If you’ve been building with Firebase AI Logic, you know the core story: direct access to Gemini from your mobile or web app, with no backend to build or maintain. Thousands of apps are already running this in production today. Developers can review the primary announcement on the [**Firebase Blog**](https://firebase.blog/posts/2026/04/cloud-next-2026-ai-logic/) alongside our implementation patterns and production checklist above. ### How do web developers use Ship production AI features faster with Firebase AI Logic with Next.js, SvelteKit, React, or Angular? Web developers can integrate these features using the modular Firebase JavaScript/TypeScript SDK, Firebase Data Connect web bindings, and [**Firebase App Hosting**](https://firebase.google.com/docs/app-hosting). Always pair client-side SDK initialization with Firebase App Check and strict Security Rules, and test locally with the Firebase Local Emulator Suite before deploying. ### Where can I watch video tutorials on Firebase Web and AI development? You can watch our hands-on Firebase video walkthroughs on the [**CodingCat.dev YouTube Channel**](https://www.youtube.com/@CodingCatDev?sub_confirmation=1), including [**Firebase SQL with Data Connect**](https://youtu.be/N25khadfUag), and follow us on [**X (@CodingCatDev)**](https://x.com/CodingCatDev) for weekly full-stack tutorials. ## Recent Posts [View More](/blog/page/1)[![PHP2Shell (CVE-2026-109618): How AI Found a Decade-Old Bug in 70% of the Web](https://cdn.sanity.io/images/hfh83o0w/production/e83065d0a4e2f841ce64d3f4aea8ddbbf07e5cb9-1376x768.jpg?w=1376&q=82&fit=max&auto=format)](/post/php2shell-cve-2026-109618-ai-php-security-scramble) ### [PHP2Shell (CVE-2026-109618): How AI Found a Decade-Old Bug in 70% of the Web](/post/php2shell-cve-2026-109618-ai-php-security-scramble) October 22, 2026 Two critical pre-authentication RCE flaws in PHP (CVE-2026-109618 and CVE-2026-109619), uncovered by AI models from OpenAI and Google Gemini, sparked a global patching scramble across 70% of the web. Here is how PHP2Shell works and how to patch your servers. [![Alex Patterson](https://cdn.sanity.io/images/hfh83o0w/production/a606dfaa381aab08ddbe16a33fe1d3e1fb37c927-400x400.jpg?w=96&h=96&q=82&fit=max&auto=format)Alex Patterson](/author/alex-patterson)[![Sanity Knowledge Bases](https://cdn.sanity.io/images/hfh83o0w/production/38b0f021c51d97043c8a1ebf31d505a0ea877b7c-2752x1536.jpg?w=1920&q=82&fit=max&auto=format)](/post/sanity-knowledge-bases) ### [Sanity Knowledge Bases](/post/sanity-knowledge-bases) October 17, 2026 Eliminate query-time guessing in your AI agents. Learn how Sanity Context Knowledge Bases compile structured datasets, crawled documentation websites, and uploaded files ahead of time, resolve conflicting facts, and serve a compact outline over Context MCP. [![Alex Patterson](https://cdn.sanity.io/images/hfh83o0w/production/a606dfaa381aab08ddbe16a33fe1d3e1fb37c927-400x400.jpg?w=96&h=96&q=82&fit=max&auto=format)Alex Patterson](/author/alex-patterson)