What's the point of a javascript API key when it can be seen to anyone viewing the js code

Question

I've seen services like Google that require you add an API key when making a javascript call, like this.

https://www.google.com/jsapi?key=thekeygoeshere

What's the point of having this javascript api key when the code can be seen and the key can be read. Can't someone just copy this key and use it for their own site? Or is there something else that they do in the background to ensure that the key belongs to the site making the call?

Answer 1

Presumably they check the referer HTTP header.

The majority of users send it. So if is:

• The site that matches the key, they can operate as normal.
• A site that doesn't match the key, they can reject the request.
• Blank, they can operate as normal and allow a tiny fraction of people to use the API on the wrong site.

The majority of visitors to a site using the wrong key will get blocked, so it won't be worth using the wrong key on the site in the first place.