Table of Contents
Overview #
Unrestricted Google Maps Platform API keys are vulnerable to abuse if exposed publicly, such as in website code or mobile apps. If unauthorized users gain access to your keys, they may generate charges on your account.
To prevent this, you should secure your API keys by applying the correct restrictions.
Why It Matters #
- Unauthorized usage risk: Anyone who finds your unrestricted key can use it.
- Unexpected charges: Usage by unauthorized third parties will be billed to your account.
- Service interruptions: Prolonged abuse can result in account suspension.
Types of Key Restrictions #
There are two main ways to secure your keys:
- Application restrictions – Control where the key can be used:
- HTTP referrers (websites)
- IP addresses (server-side apps)
- Android apps (package name & SHA-1)
- iOS apps (bundle ID)
- API restrictions – Limit the key to specific Google Maps Platform APIs.
Note: Each key can only support one application restriction type. If you use a key across multiple platforms (e.g., web and mobile), create and restrict separate keys for each.
Steps to Restrict Your API Keys #
- Sign in to the Google Cloud Console.
- Go to APIs & Services > Credentials.
- Find the key you want to secure.
- Click the edit icon next to the key.
- Under Application restrictions, select the correct restriction type (e.g., HTTP referrers for websites).
- Add the allowed values (for example:
https://example.com/*). - Under API restrictions, limit the key to only the APIs you use.
- Save changes.
Best Practices #
- Use different keys for each environment (development, staging, production).
- Separate keys per platform (web, iOS, Android, backend).
- Apply both application and API restrictions for stronger protection.
- Review and rotate keys regularly to reduce risk.
