A few weeks ago I realeased a module to use Google Firestore as an external database for your game/group but I never implemented actual security rules and currently the only key is the GCP project name that is not very secure.
I wanted to use authentification in order to use the REST API of firestore but cant find a way to do it using service accounts or any other secure method.
So if you ever managed to do that or have ideas on how to do it please share them 
Thanks