RealComposer
START FREE
Upstream APIsOfficial Google Maps docs

Google Maps Safe & Unsafe Practices

Direct Answer

Google Maps JavaScript and mobile SDK keys must ship to clients, so they are only safe when restricted by HTTP referrer or app signature and limited to specific APIs. Web service calls like Geocoding and Places should use a separate server key behind a proxy.

Credentials & Where They Belong

Client safe
Restricted browser or mobile key

Safe only with application and API restrictions applied.

Server only
Server key for web services

Used for Geocoding, Places, and Routes from trusted code.

Safe Practices

  • Apply application and API restrictions

    Lock browser keys to your domains and mobile keys to bundle IDs or SHA-1 fingerprints.

  • Set per-API quotas and budget alerts

    Caps prevent a leaked or abused key from creating a surprise bill.

  • Cache geocoding results within allowed terms

    Repeated lookups for the same address add cost and latency.

Unsafe Practices

  • Shipping an unrestricted key

    Scrapers will reuse it for their own apps on your billing account.

  • Using one key for client maps and server web services

    Server APIs cannot be referrer-restricted, so sharing the key leaves it open.

The RealComposer Pattern

Store a server-restricted GOOGLE_MAPS_KEY in the vault for Places and Geocoding pipelines with edge caching, and keep only the referrer-restricted key in clients.

START BUILDING FREE

Frequently Asked Questions

Q:Is it safe to put a Google Maps key in my website?

Yes, if it is restricted to your domains and to the Maps JavaScript API. Unrestricted keys get abused quickly.

Google Maps Recipes

All Google Maps recipes (2)
Frontend / WebGoogle Maps
Edge Caching & Rate Limits

Cache Google Places Autocomplete API to Reduce Bills

To solve cache google places autocomplete api to reduce bills, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
Frontend / WebGoogle Maps
Security & Secret Vault

Hide Google Maps API Key in Web App

To solve hide google maps api key in web app, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe

Related Concepts

API Key

An API key is a unique secret string that identifies the application calling an API and authorizes its access. Providers use keys to authenticate requests, enforce quotas, and bill usage. Anyone holding the key can act as your application, so secret keys must stay on trusted servers.

Allowed Origins (Origin Allowlist)

Allowed origins are a configured list of website domains permitted to call an API from a browser. The server or gateway checks the Origin header of each request and only returns CORS permission headers, or accepts the request, when the origin is on the allowlist.

Edge Caching

Edge Caching is the practice of storing computed API responses on globally distributed Point of Presence (PoP) servers situated geographically close to users. By serving cached responses directly from edge memory, requests achieve sub-10ms latencies while offloading 95%+ of traffic from origin databases.