Google geocoding API security

Question

I am asking this question after extensively reading Google's recommended approach, but I do have a problem with all these approaches, let me explain the situation.

I use combination of geolocation and geocoding API to know the approximate state location and then display relevant content. The geolocation API needs to be called obviously from the browser to get appropriate geolocation of the user. Google provides HTTP Referrer based restriction for this API. I know someone can easily spoof the referrer and make calls with the same API key. I do not see a huge advantage even though Google recommends this.

On the other hand Google does not allow HTTP Referrer for geocoding API, but it does allow that for the MAPS JavaScript API. But again if you are not using Google maps then using that API is violation of Google's terms. Now google recommends to move the code that uses geocoding web services API to be on the back-end so that your key will be protected. But since ultimately I need to deliver the result to a front-end web application that is publicly accessible and I can only make a browser based Ajax call to first get the geolocation to feed to geocoding, I ultimately need to make an Ajax call to get my geocoding information. Then someone can easily just latch onto my end-point to piggy back on and call the geocoding API as much as they want. So for situations like this I want to know what is the ideal and secured way to deal with. May be there are other APIs that might be an ideal situation for this.

Answer 1

In my case, I am not doing any maps so it's all purely server-side to get latitudes, longitudes and driving distance between two points. This today from Google support which might help and if you're using maps, then the links may provide further insight.

Regarding API restrictions, please note that HTTP referrers will not work on Geocoding API since HTTP referrers can only be used for client side services. In other words, Geocoding is a web service API and should only be used on server-side implementation. IP address restrictions should be used for web service APIs. However, if you are using the Geocoding API in a website, IP address restriction would not work. Please check the suitable restrictions for each API in the following link:

https://developers.google.com/maps/api-key-best-practices#api_key_table

To make this work, you should create a separate key and use the new one in your Geocoding API request URL. You may add a restriction to this key by using an "API restriction", and restrict it to Geocoding API only. If you don't want to create another key, you may keep using your current one but make sure to change your implementation and use the client side Geocoding service from the Maps JavaScript API. In that case, please refer to this documentation:

https://developers.google.com/maps/documentation/javascript/geocoding

Another suggestion would be to get a static IP address from your ISP, especially if you are planning to use it on a public website. For development purposes, a sound solution would be to get three separate keys: one for the staging and tests, another for server-side requests and a third one for client-side requests. That way, you are making sure your API key is protected.