diff --git a/src/firebase.js b/src/firebase.js
index 281f3403..79bd0b86 100644
--- a/src/firebase.js
+++ b/src/firebase.js
@@ -10,6 +10,13 @@ const productionDB = "https://cioos-metadata-form.firebaseio.com";
 const devDB = "https://cioos-metadata-form-dev.firebaseio.com";
 
 const config = {
+  // see https://console.cloud.google.com/apis/credentials?project=cioos-metadata-form
+  // and https://console.cloud.google.com/apis/credentials?project=cioos-metadata-form-dev
+  // for api key location which is then stored in a github secret and added to several
+  // github actions to support testing and deployment.
+  // see https://firebase.google.com/docs/projects/api-keys for a discussion of why we 
+  // don't need to restrict api keys for firebase but might in some situations.
+  // To prevent the future foot gun, we are restricting the key now.
   apiKey: process.env.REACT_APP_GOOGLE_CLOUD_API_KEY,
   authDomain: "cioos-metadata-form.firebaseapp.com",
   databaseURL: