I'm trying to create an electron app, and I decided to use firebase (email/password) for authentication. Right now, the app directly sends the request to login via firebase.auth().loginWithEmailAndPassword and thus the app also has the API keys stored. If someone were to decompile /reverse engineer / investigate HTTP requests with this app, would it be possible to get the API key and create users as they please.
The only solution I thought of was proxying everything behind another server that takes care of more logic, is this the only way to prevent something like this?