Just to keep all the discussion in one place, I’m replying to your message here.
If you use your master api_key in your android app then you have serious security issue. Developers can decrypt your app and can get api key easily.
Firebase will return IdToken on successful login. You should send this to your server and validate it using one of the methods in Verify ID Tokens | Firebase Authentication. If it successful you can generate user api_key on server itself and send to android client.
Also you can store the user api_key (not master api_key) on Firebase behind auth rules and retrieve anytime.