Configure an API Key for use in Cloud Run

[gebejaranod]

I want to use the Google Geocoding service from a function in Claude Run, but it returns the REQUEST_DENIED error. How do I configure the API_KEY web side restriction to allow me to use it from Claude Run?

[Joy_S · Accepted solution]

Hi @gebejaranod,

Welcome to Google Cloud Community!

The REQUEST_DENIED error when using the Google Geocoding API from CLoud Run usually due to incorrect API key restrictions. HTTP Referrer restrictions, designed for browsers, will not work with server-side Cloud Run. To fix this, I would recommend any of the two options:

1. IP Address Restrictions with a Static Outbound IP:  This method involves routing your Cloud Run's outbound traffic through a static external IP address. You'll need to:
   • Reserve a static IP.
   • Set up a Serverless VPC Access Connector and a Cloud NAT Gateway to route Cloud Run traffic through this static IP.
   • Finally, apply an IP address restriction to your API key in the Google Cloud Console, using the static IP.
2. Service Accounts and Secret Manager: This more secure approach focuses on managing your API key's access rather than its network origin: 
   • Use a dedicated service account for your Cloud Run function with minimal permissions.
   • Store your API key securely in Google Cloud Secret Manager.
   • Grant your Cloud Run service account permission to retrieve the API key from Secret Manager at runtime.
   • Use Google Maps Platform Client Libraries to simplify API calls, fetching the key from Secret Manager.

This method enhances security by keeping your API key out of your code and deployment configurations.

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.