What does it mean to restrict API key?
Application restrictions limit an API key’s usage to a specific platform (Android or iOS) or specific sites (public IP address and web site). API restrictions limit usage of API keys to one or more Google Maps Platform APIs or SDKs. Only requests to use APIs or SDKs associated with an API key will be processed.
How do I protect my Google API key?
To help keep your API keys secure, follow these best practices:
- Do not embed API keys directly in code.
- Do not store API keys in files inside your application’s source tree.
- Set up application and API key restrictions.
- Delete unneeded API keys to minimize exposure to attacks.
- Regenerate your API keys periodically.
How is HTTP referer restriction used in Google Maps?
HTTP referer restriction is used for client side services like Google Maps JavaScript API, it won’t work with web services. To accept requests over localhost and HTTP (HTTP referrers) in Google Maps API, follow the instructions in the javascript console printed out by the Google Maps API ( it tells you exactly what to do ):
What is the point of restricting a Google API key by HTTP?
Someone that “has the valid referer” can not normally use it on their own site because the referer header can not be modified programmatically in the browser. This prevents people from simply stealing your key and adding it to their HTML. But the referer can surely be changed on the server, where you’re free to change anything in the request.
What are the different types of API restrictions?
There are two types of API key restrictions: API restrictions and application restrictions. Application restrictions limit usage of the API key to a specific web site, web server, or application. Google Maps Platform supports four types of application restrictions:
What are application restrictions for Google Maps Platform?
Application restrictions limit usage of the API key to a specific web site, web server, or application. Google Maps Platform supports four types of application restrictions: HTTP referrers: restricts usage to one or more URLs and is intended for keys that are used in websites and web apps.