I think to use Firebase Database might be a little overkill, considering that you don’t want to use Database. Have you considered to use Remote Config? Remote Config is exactly suitable for your use case, also it’s a great way to gate your new features, A/B testing, etc. But unfortunately you would still need to google-service.json to your app, honestly don’t think you can avoid it.

Let me know if you found a way to avoid adding google-service.json to the app and have a secure access to it.

I have Firebase Database link

this link as example
https://my-tempdb-rtdb.asia-southeast1.firebasedatabase.app/db.json

In my android app I need some static parameters which are change only once in month so I did use firebase and getting response as json. I want to use as json not want to implement database library for fetch data cause this use in multiple apps so don’t want to add google-service.json file for that so I did fetch response in json format.

{
    "wert": true,
    "kert": 1
}

I’m using this url as GET request in retrofit.
In firebase write rules are set as false. So no one can write but me.

So My question is I want to pining to this url so no one can missuses this url with man in middle attack. How to do this?