- Go to this address: https://console.developers.google.com/apis
- Create new project and Create Credentials (API key)
- Click on "Library"
- Click on any API that you want
- Click on "Enable"
- Click on "Credentials" > "Edit Key"
- Under "Application restrictions", select "HTTP referrers (web sites)"
- Under "Website restrictions", Click on "ADD AN ITEM"
- Type your website address (or "localhost", "127.0.0.1", "localhost:port" etc for local tests) in the text field and press ENTER to add it to the list
- SAVE and Use your key in your project
https://developers.google.com/maps/documentation/embed/embedding-map
Why does it make sense for Google to require an API key to embed their Maps web application via iFrame in another website (some-site.com)?
-
The API key can be copied and used by anyone who visits the website (some-site.com)
-
Google is anyway expecting the Referrer some-site.com in the request and I expect they track the usage looking at the referrer
What am I missing? Why do they require an API key?
I'm here to learn.
google maps - Googlemaps API Key for Localhost - Stack Overflow
Where the heck is the map key hidden for Google Maps?!??? I have searched in vain for it. - Google Maps Community
How to secure google map api key
How to get an API Key for Google Maps - iKeyMonitor Guide - Guides - iKeyMonitor Community
Videos
- Go to this address: https://console.developers.google.com/apis
- Create new project and Create Credentials (API key)
- Click on "Library"
- Click on any API that you want
- Click on "Enable"
- Click on "Credentials" > "Edit Key"
- Under "Application restrictions", select "HTTP referrers (web sites)"
- Under "Website restrictions", Click on "ADD AN ITEM"
- Type your website address (or "localhost", "127.0.0.1", "localhost:port" etc for local tests) in the text field and press ENTER to add it to the list
- SAVE and Use your key in your project
If you are working on localhost, create a separate APIkey for your development and then remove restrictions on that key so that your localhost can use it. Remember to not use this key on production, so you don't expose your key to hunters online.
I had the same issue and all attempts to get the restrictions working on my localhost environment was not successful until I created a separate apikey specifically for development and then removed its restrictions. However I don't use that key on production environment, and once am done with developments, I will delete the API key immediately.
I Know this post is late, but for people that will likely face this issue in the future, this is the best route to go.
As far as i ve checked, the api key should be in android manifest which will be used by the MapView that we are using in the app. But the problem is if i decompile my app, i can see my api key in the manifest.
I even checked the apk (cloned the repo found in android documentation website itself which has the example on implementing maps in project), its the same.
How to secure it? I saw that we can use google console and we can restrict the use of api, but still the api should be set in manifest and still it can be decompiled and misused. How to solve this?