Huge billing for API Places from a domain i don't own

[Bruntho]

Hello everyone,

I use Google Maps API since several years. Sometimes i have small billings but usually i'm at 0$. Last month, it costed me way more than usual. When i'm looking for the reason, i found that api has been used a lot. So with the filters, i choosed to filter by domain and curiously, there are all my usuals domains + google.com and waze.com.

And the usages has been made by waze.com.

I dont understand why usage could have been made from waze.

Can someone help me with that ?

Thanks a lot, Regards. Bruntho.

[CarlS]

I have the  same issue with the same domain waze.com making 5000 calls per day on average. Since the end of june 2023, I now start to have cost which wasn't the case in the past.

[igceuk]

We have the same issue here with huge billings from waze.com on Places API. At first we attributed it to unprotected API keys, fair enough, but waze.com seems to be a Google company so why would they need to steal API usage?

[ariankuschki]

One of our customers seems to be affected by this as well. Did you find out the reason for these charges?

[jiriczzcek]

Same to me, domain waze.com, invoice for $500 😞

[CarlS]

Google told me that they can spoof the domain where the key is used. Restrict your keys for your domain only is the only way they said.

But if they can spoof the domain, they'll probably be able to spoof the domain where the key is stolen so the restriction is useless...

[Bruntho]

Hi,

it has been a perfect occasion to restrict all my keys and to be very attentive of what sites can be very demanding with api. 

also I contacted the customer department, and they helped me a lot. I would recommand you to write the billing or customer support. 

Regards

[Pilig]

Same for us with the same domain waze.com. We are not using something link to waze in our project ... inexplicable 

[pgstorm148]

There are a few possible reasons why Waze might be using your Google Maps API key:

• Waze is a Google product, and Google products often share data with each other. This is done to improve the user experience and make the products more useful.
• Waze may be using your API key to access Google Maps data for its own purposes, such as providing traffic updates or routing information to its users.
• Waze may be using your API key for internal development or testing purposes.

If you are concerned about Waze using your API key, you can contact Google support to inquire about the matter. You can also disable your API key or restrict it to specific domains.

To disable your API key, follow these steps:

1. Go to the Google Cloud Platform Console.
2. Click on the hamburger menu in the top left corner of the page.
3. Select IAM & admin > APIs & Services > Credentials.
4. Find the API key that you want to disable and click on the three dots next to it.
5. Select Disable API key.

To restrict your API key to specific domains, follow these steps:

1. Go to the Google Cloud Platform Console.
2. Click on the hamburger menu in the top left corner of the page.
3. Select IAM & admin > APIs & Services > Credentials.
4. Find the API key that you want to restrict and click on the three dots next to it.
5. Select Edit restrictions.
6. In the HTTP referrers section, enter the domains that you want to allow the API key to be used with.
7. Click Save.

If you have any further questions or concerns, please contact Google support.

[mdalaminsabbir]

I got invoice for $12000.