I am new to client-side development and I have a naive question. Right now, I'm using Google APIs (the map ones). If I want my client-side application / webapp to display a map, I would include something like this in my index.html:

<script src="https://maps.googleapis.com/maps/api/js?key=MY_API_KEY"></script>

The API key in this snippet would have only the required permissions (let's say "get the map"). Even though the permissions of the key are restricted, it's still readable by an attacker. And every "get the map" action costs a bit of money.

How would I prevent an attacker from using this key to make millions of requests and drying my bank account?

  • 1
    Instead of making your app a wrapper for the Google API, why not send requests to your service?
    – schroeder
    Commented Nov 23, 2023 at 18:56
  • I could indeed, but then that's 2 extra hops before my users get the data, and that's an extra load on my service. I was basically asking what's the standard practice in the industry. Everybody must have done that at some point
    – Rififi
    Commented Nov 23, 2023 at 19:12

1 Answer 1


Well, secrets should never lie unprotected on client-side indeed. But you have few options here:


  • after reviewing the latest TOS of Google and their FAQ it appears that the second proposal ("served static maps") could not be allowed by Google. Make sure you respect all terms and conditions (general and API-specific), including no caching, no storing.. of Google Maps Content. It does not seem though that Google specifically enforces and requires the use of static maps in embedded src links for this case (anymore). Please double-check as needed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .