In many cases, I have to add a public API key to my website (or application). For instance, in order to have an embedded map on a website, one could use google maps, and be required to provide an API key.

I believe this issue applies for every service based on this model, like translation, analytics, etc.

What prevents clients to reuse the same API key within their own website?

  • 1
    Have you done some reading already? I found this helpful article: cloud.google.com/endpoints/docs/openapi/when-why-api-key – schroeder Mar 12 '19 at 9:17
  • Thanks for the link. However this does not really answer the question, unless the answer is nothing. If the API key is used to identify my project, but is not secret, then I can't see how I'm protected from a malicious attacker that would use my API key in order to use my credits... – Richard Mar 13 '19 at 1:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.