5

There's something I don't understand about signatures in Google Maps APIs.

The documentation says "We strongly recommend that you use both an API key and digital signature, regardless of your usage". In this case we are talking about the Maps Static API, where requests are made by the frontend with a URL that generates an image to embed on your website. API keys should be restricted by referrer, so nobody else will be able to steal your key and use it in another project. So what's the purpose of also adding a signature to the request?

As far as I know, signatures are used to make sure the request isn't modified by an attacker. But I don't think any parameters in Google Maps APIs can be abused in this case. What's even more confusing is the fact that if you check out other Google Maps APIs like the Distance Matrix API or the Roads API, they only recommend you restrict your API key (by referrer) and don't mention anything about adding a signature.

So is a signature really needed or not? And why?

3 Answers 3

3

As mentioned in this answer: https://stackoverflow.com/a/67080938/2054671

The digital signature is valid for one particular url, so if you are a business using maps static for showing your location on your website, and you worry about the fact that someone else can abuse your quota limit by using your key for other static maps requests, you can just sign the static maps url that you use, and disable non-signed urls in your dashboard. This will make sure that your API key would not work without a digital signature, and the digital signature would only be valid for one particular URL.

So, no one can use your api key for any other maps URL

Not sure, how this would be useful for Roads or Places API where the urls would be different for each call, and you cannot pre-determine all the URLs and sign them. Possibly this is why they don't talk about digital signature in those APIs

1
  • You dynamically key them. There is sample code for this. Obviously this is no protection at all if they want the same map, either. Nor does it prevent scraping.
    – mckenzm
    Commented Mar 9, 2023 at 22:03
1

The digital signature is a way that you can tell Google "I have validated this request, let it through". You may choose to do no validation and just sign the request, or you may choose to do some validation of your own before signing the request. The point is that it allows you to be the gatekeeper.

0

Referrer restrictions are typically enough to prevent someone from reusing your API key in JavaScript on their own website, because the browser enforces the referrer information. But outside of a browser, referrer information can be easily faked (see: referer spoofing). So those restrictions are not enough to prevent someone from using your API key to send requests from a server, or from an offline tool. I believe preventing that is the purpose of these digital signatures.

1
  • I don't understand how digital signature would be able to help with that
    – gaurav5430
    Commented Apr 21, 2021 at 7:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .