Exposed Google API Key? Here's how to detect and rotate it

A Google API key (starting with AIza) authenticates calls to Google services like Maps, Cloud, and other APIs, and bills usage to your Google Cloud project. If the key is unrestricted, anyone who finds it can call those APIs on your project until you revoke or lock it down. Restricting a key to specific APIs and referrers limits the blast radius, but a leaked unrestricted key must be deleted or rotated.

What an attacker can do with a leaked Google API Key

• Runs up your Google Cloud bill by hammering paid APIs like Maps, Geocoding, or Places on your project.
• Blows through your quotas, breaking Maps or other API calls in your own app.
• Uses your key to power their own apps or resells it as free Google API access.
• Probes which APIs the key can reach if it was never restricted, widening the abuse.

How Google API Keys get exposed

• Hardcoded in a client-side web or mobile bundle where anyone can read it in DevTools.
• Committed to a public repo in a config file, .env, or firebase config object.
• Baked into a shared script, notebook, or Dockerfile that got pushed or sent.
• Exposed in a screenshot, log line, or pasted snippet in chat or a forum.

How to rotate a leaked Google API Key

1. Go to console.cloud.google.com/apis/credentials and pick the affected project at the top.
2. Find the leaked key under API Keys, open it, and click Delete — or click Regenerate/Rotate key to swap it.
3. Note that deletion propagates gradually, so treat the old key as live for up to ~30 minutes.
4. Create or edit the replacement key and add Application restrictions (HTTP referrers, IPs, or app) plus API restrictions so it only calls the services you need.
5. Update your server environment or secrets with the new key and redeploy; never ship it in client code unrestricted.
6. Open APIs & Services → Metrics (and Billing) to check for usage spikes or unexpected API calls from the abuse window.

Open the Google API Key dashboard →