I know that appKey
is not a means of authenticating applications. But I am wondering what are the best practices for avoiding quota theft for open APIs, that are not associated with any user account. Google Maps API could be one such example of these APIs. Including the appKey
inside the clients (browser application, mobile clients) make them vulnerable to appKey
theft.
For the reference, here are Google's recommendations: https://support.google.com/cloud/answer/6310037
It could be a wrong assessment, but is OAuth 2.0 Client Credentials flow with a proxy server suitable in such scenarios? Are there any real-world cases?