Received email about publicly accessible API key but it's restricted by website

[larrybread]

Hello - I received an email about an API key being publicly accessible in my source on webpage of a site I look after. I've restricted use of this API key in the Settings & APIs > Credentials section of my console, under 'Website restrictions'; to the domain in question, with the format https:/www.mydomain.com/*

Is this still a concern? The API restriction is for Maps, Places, Geocoding.

My understanding was that with these Website and API restrictions in place, having the API key in the public source was not an issue but am I mistaken?

Thanks

[RMaynes]

Curious about this too since receiving a similar email.

[Marvin_Lucero]

Hi @larrybread ,

Can you share a screenshot of the email?

[larrybread]

Email received from noreply+google-cloud-compliance@google.com

https://www.dropbox.com/s/tdachec2kusmgyn/email.png?dl=0

This is an old post but seems relevant: https://stackoverflow.com/questions/39625587/how-do-i-securely-use-google-api-keys

[LarryNic]

Hi @larrybread ,

If you have already added restrictions to your API keys, then this should be resolved. I recommend reviewing the documentation on the Remediaton for Exposed GCP API Keys and Authenticating Best Practices for API keys.

 Aside from this, I love Maps, Places, and Geocoding. If you ever need someone to colloborate with just let me know! 

[larrybread]

To follow up, I've left all my sites with website/domain restrictions as before. Not IP restrictions as apparently this will stop these apis working.

I also receive another, identical email today about one of these sites (not the one in my original post), so I guess this is something that is ongoing.

I've run up against another issue in that I'm using a Google Reviews plugin (WordPress) on one of these sites that has recently stopped importing new reviews. Apparently the Places API will not import these with restrictions in place. As this only seems to have become an issue recently I wonder if API changes are taking place in the last month or two that are at the root of all this.

https://maps.googleapis.com/maps/api/place/details/json?placeid=XXXX&key=XXXX

yields:

{
   "error_message" : "API keys with referer restrictions cannot be used with this API.",
   "html_attributions" : [],
   "status" : "REQUEST_DENIED"
}

[Mcn]

Hello

I am not a developper but i have made my own wordpress for my business.

I have received the same email 2 weeks ago and i have no idea what this is about... 😯

How bad is the situation please? Do i need to do something?

Thank you 

[Anitha]

We are also getting same error when we access the geocode Api. Any solution for this issue