I have obtained a Google Maps API key for my domain.
The examples provided when I obtained my key show the key embedded in request parameters, for example:
<script src="http://maps.google.com/maps?file=api&v=2&sensor=true_or_false&key=my-key" type="text/javascript"></script>
I appreciate that the referrer field in requests must match my domain, is it safe to make my key visible in script tags and the like? Or are there any other steps I should take?
Considering that key has to be included in the <script>
tags of your HTML pages, to load the JS files/data from google's servers, there is nothing you can do :
Still, it doesn't really matter : if anyone tries to use this key on another domain than yours, they will get a Javascript alert -- which is not nice for ther users.
So :
There is setting on Google API console that can protect your API bandwith usage from being used by another domain/user. You can restrict and protect that by using referrer on the API console. API Key will reject requests without referrers that match your restrictions.
Here is screenshot from Google for API Key that can only be used by Google frowm its two domains.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With