Firebase AI Logic Puts a Gatekeeper on Every Gemini Request

Firebase AI Logic now runs developer-written Cloud Functions before and after every Gemini request, letting teams moderate, cap or redact calls server-side.

Firebase AI Logic can now run a developer’s own Cloud Functions immediately before and after every request an app sends to the Gemini API, according to Firebase’s Sept. 10, 2026 release note introducing the capability. The hooks let a team moderate prompts, cap token spend or redact a response without touching client code, all from server-side functions they control.

What changed #

Two trigger types, deployed with the Firebase CLI as ordinary Cloud Functions:

• beforeGenerateContent runs first. It can inspect a request, rewrite it, or throw an error to block it outright before it reaches Gemini.
• afterGenerateContent runs last. It can inspect, modify or block Gemini’s answer before the client app ever sees it.

Firebase’s documentation lists prompt moderation, token-usage caps, generation logging for analytics, and response redaction as the intended use cases, the kind of server-side control that previously meant routing every Gemini call through a custom backend instead of calling it straight from the client. The feature needs firebase-functions 6.3.0 or later and TypeScript, and Firebase caps each project at one function per trigger type. It only fires on generateContent calls; streaming responses and the Live API aren’t covered.

Firebase marks the feature Preview, its label for capabilities with no SLA and no deprecation policy that can still change in breaking ways.

Why it matters #

Firerun’s take: this closes a gap in Firebase AI Logic’s pitch. The whole appeal of AI Logic is calling Gemini directly from a mobile or web client without standing up a backend, but that same directness has always meant no place to enforce a token budget or scrub a response before a user sees it, short of building the proxy server AI Logic was supposed to make unnecessary. Two narrow hooks aren’t a full gateway (no streaming support, one function per trigger), but they cover the moderation and cost-control cases that push teams toward a custom backend in the first place. Shipping it in Preview is the tell: expect the one-function-per-trigger limit to be the first thing teams ask Firebase to raise.

Key Takeaways #

• Firebase AI Logic can now run Cloud Functions before and after every Gemini generateContent request, with no client-side code changes.
• beforeGenerateContent can inspect, modify or block a request;afterGenerateContent can inspect, modify or block Gemini’s response.
• Built-in use cases: prompt moderation, token-usage caps, analytics logging and response redaction.
• The feature is in Preview , limited to one function per trigger type per project, and doesn’t yet cover streaming or the Live API.