Home/ Questions/Q 621441
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T18:52:28+00:00

Currently Google requires you to create an API Key that is specific to the

  • 0

Currently Google requires you to create an API Key that is specific to the domain of where the map will be served from. How does Google enforce this? I want to do the same thing.

I expose an API for my service but want to allow clients to embed calls to the API via javascript and not just from the server. I could secure it with just a random token but of course this could be easily spoofed by anyone looking at the code on the client machine.

I always understood this concept to not be possible but somehow Google does a good job at enforcing it.

Edit – It sounds like Google really hasn’t done anything amazing after all. Their API is most likely just for tracking and not really to guarantee that their API is used by the person with the key.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I’m quite certain they use the REFERER URL to determine where the call is coming from. If the domain doesn’t match what’s assigned to the key, it’s an invalid request.

    For a practical example, using PHP you can check the domain using $_SERVER['HTTP_REFERER'] to check the referer. If the domain matches, return a valid response. If it doesn’t, you can return a 401 Unauthorized or other response.

    • 0