Lock down your Google Maps API key

The Maps JavaScript API loads in the visitor's browser, with your key in the script URL or the loader config. Anyone can open DevTools and read it. You can't hide it, so Google has you restrict where it works and which APIs it can call.

An AIza key is a general Google Cloud API key, the same format Firebase and the Gemini API use. What a particular key can call depends on two things: which APIs are enabled in its project and which APIs the key itself is restricted to.

• Other sites and apps can embed maps with your key, billed to you.
• Scripts can call web service APIs like Geocoding, Places and Directions with it directly.
• With no API restriction, it works for any API enabled in the project, which could include paid services such as the Gemini API if you turned it on there.
• Heavy use can hit your quotas, so your own map stops loading.

1. Open Google Cloud Console, go to APIs and Services, then Credentials, and click the key your site uses.
2. Under Application restrictions choose Websites (HTTP referrers) and add your domains, like the list below. Use a separate key for localhost during development rather than adding localhost to the production key.
3. Under API restrictions choose Restrict key and tick only what the page uses, for example Maps JavaScript API, plus Places API if you use autocomplete.
4. Save. Changes can take a few minutes to apply.
5. Set quota caps on each Maps API so a spike can't run all month, and add a budget alert in Billing. Budget alerts notify you; they don't stop spending.

https://example.com/*
https://www.example.com/*
https://*.example.com/*

A referrer restriction stops other websites reusing your key, but a script outside a browser can fake the Referer header. That's why the API restriction and quota caps matter too: they limit what a determined person can do.

If your server also calls Geocoding or Places web services, don't reuse the browser key. Referrer restrictions don't apply to server-side calls. Create a second key, restrict it by IP address if your server has a fixed outbound IP, restrict it to only the web service APIs it calls, and keep it in a server-only env var.

Serverless hosts often don't have a fixed IP. In that case the server key relies on its API restriction, quota caps and simply never leaving the server.

Call a web service API with the key from your terminal, where there's no referrer:

curl "https://maps.googleapis.com/maps/api/geocode/json?address=London&key=YOUR_KEY"

A status of REQUEST_DENIED mentioning referer restrictions, or a message that the API isn't allowed for this key, is what you want. A status of OK with results means anyone can use the key from anywhere.

1. Add both restrictions now. That stops casual reuse within minutes.
2. If the key ran unrestricted and usage looks wrong, create a new restricted key, deploy it, then delete the old one.
3. Review the API metrics and billing reports per API to see what was used and when.
4. If there are charges from abuse, raise it with Google Cloud billing support. There's no guarantee of a refund, which is why quotas are worth setting up front.

If our scan finds an AIza key in your page HTML or your site's JavaScript, it flags the key so you can confirm it's restricted. It can't see a key's restrictions from outside, so the curl above is how you check.