Unexpected 87,800 Requests in One Day to Google Places API

[salamexperts]

Hi everyone,

I noticed an unusual spike in usage on my Google Places API — exactly 87,800 requests were made on April 17th, and no other significant activity was recorded on any other day. This level of usage seems far beyond what our own site could have generated.

I want to ask:

• Has anyone faced a similar issue where the API key was unintentionally exposed or misused?

• What are the best steps to audit and secure the key?

• Is there a way to identify the origin of the requests or domains where the key was used?

Any advice or direction would be really helpful. Thanks in advance!

[a_aleinikov]

Hi @salamexperts ,
Yes, this can happen if the API key was exposed (e.g., in frontend code or public repos).

Here’s what to do now:

• Restrict the key in Google Cloud Console → only allow specific referrers (websites), IPs, or apps.

• Rotate the key — create a new one and replace it in your app.

• Check logs in Google Cloud → look at API metrics and request origins (though Places API has limited request origin detail).

• Set budget alerts to avoid surprise costs.

Act fast — unrestricted keys are a common cause of misuse.

[salamexperts]

Thank you for your previous guidance and for helping implement the necessary security measures on our account. We appreciate your support in ensuring our account is now more secure.

However, I would like to kindly request if your team could further assist by reviewing the recent billing activity on our account. We suspect that some of the charges may have resulted from unauthorized usage prior to the enhanced security measures.

If possible, we would greatly appreciate any consideration for a billing adjustment or favor, as this would help us manage the impact of the unexpected charges.

Thank you for your understanding and support. Please let me know if you need any additional information from our side.

Best regards,
Salam Experts