6

Normally, I'd say yes, api keys should be kept secret, and Google's api console even says that. However, I'm just making an ajax get call and all the info is in the clear on my page in order to construct that query, including my api key and cx(custom search engine id). Presumably, someone else can use my credentials to make queries against my daily limit.

Google does let you specify a whitelist of referrers who are allowed to use your cse by domain. Does that somewhat mitigate this issue? If they are just using HTTP_REFERRER, can that be faked?

Any thoughts?

Improve this question
0

1 Answer 1

Reset to default
11

Google uses the API key to identify who is sending those requests. Google will impose a quota. As you've correctly identified, if Google receives too many requests using that API key, they'll blacklist the API key. If that happens, your own site/app will stop working.

Therefore, there are risks to leaving the API key in the clear on your page. These risks are somewhat modest: someone who gains the API key doesn't get root on your systems, but they might end up causing your app to stop working.

If this risk bothers you, then don't put the API key on your web page. Instead, have the client issue an AJAX request to your server, and then have the server issue the request to Google and return the results back to the client. This way, the Google API key is never exposed to the client.

The Referer header check prevents someone else from copying your API key and putting it in their own web page and using Javascript to query Google. However, it does not prevent them from copying your API key and using it in requests they initiate from their own machines. (If they use curl or some other similar library on their own machine, they can forge the Referer header and make it say whatever they want. Therefore, the Referer check does not help prevent this scenario. It only prevents others from embedding the API key in their web page and using it in Javascript that runs in the browser of folks who visit their web page.)

Improve this answer
2
  • It's not completely about getting my cse blacklisted by Google, but rather they charge $0.005 per query, so I'd rather not pay for someone else using my credentials. Also, yes I thought about moving it to call from my server, but 1. it's an added roundtrip 2. i'd have to implement a unique token per page/submit to make sure someone else isn't calling my ajax api, then a remote ip check to make sure they aren't just loading up my page to get fresh tokens. just a lot of work and extra latency.. no better solution for this?
    – user10423
    Jun 6, 2012 at 17:06
  • Also now in 2021, they can steal money from you by making you pay for their requests.
    – Edza
    Apr 11, 2021 at 8:26

You must log in to answer this question.