Restrict or rotate the exposed Google API key

How to fix

1. 1 Restrict the key in Google Cloud Console (API restrictions and HTTP referrer/application restrictions), or regenerate it if restricting it isn't possible. This is what actually limits what the exposed key can do.
2. 2 Move any use that does not need to run in the browser to a server-side environment instead.
3. 3 Purge the old, unrestricted key from git history if it was ever committed.
4. 4 Redeploy and confirm the restrictions are active on the key that actually ships in the new build.

Common mistakes

• • Regenerating the key without adding API and HTTP referrer restrictions, so the new key is just as exposed as the old one the moment it ships.
• • Assuming a key is safe because it 'only' does something read-only: the risk with this credential is billing and quota abuse, not data access, and read-only calls still cost money.
• • Leaving an old, unrestricted key active in the project's credentials list after issuing a new one, so both remain usable.

How to verify

1. 1 Re-run the scan and confirm the finding is gone, or that the key is now restricted rather than unrestricted.
2. 2 In Google Cloud Console, confirm the key's API and referrer/application restrictions are actually saved and active, not just entered.
3. 3 Attempt a call with the key from an origin outside the allowed referrer list and confirm it is rejected.

Related checks