I have an API key specifically for Firebase and I have it restricted like so:
However, when I connect to Firebase from a different website (on front-end side) it still w