That's standard for Firebase apps. It's also recommended by Google (they describe the keys as "public by design").

Feels like a confusing thing to name "key" if it's presumably more of an identifier.