I know that
appKey is not a means of authenticating applications. But I am wondering what are the best practices for avoiding quota theft for open APIs, that are not associated with any user account. Google Maps API could be one such example of these APIs. Including the
appKey inside the clients (browser application, mobile clients) make them vulnerable to
For the reference, here are Google's recommendations: https://support.google.com/cloud/answer/6310037
It could be a wrong assessment, but is OAuth 2.0 Client Credentials flow with a proxy server suitable in such scenarios? Are there any real-world cases?