What steps should I take to protect my Google Maps API Key?

Question

I have obtained a Google Maps API key for my domain.

The examples provided when I obtained my key show the key embedded in request parameters, for example:

<script src="http://maps.google.com/maps?file=api&amp;amp;v=2&amp;amp;sensor=true_or_false&amp;amp;key=my-key" type="text/javascript"></script>

I appreciate that the referrer field in requests must match my domain, is it safe to make my key visible in script tags and the like? Or are there any other steps I should take?

Answer 1

Considering that key has to be included in the <script> tags of your HTML pages, to load the JS files/data from google's servers, there is nothing you can do :

• you must put it in your HTML files
• every one can take a look at those.

Still, it doesn't really matter : if anyone tries to use this key on another domain than yours, they will get a Javascript alert -- which is not nice for ther users.

So :

• There is nothing you can do ; this is the way it works
• And there is not much you should worry about, I'd say.

Answer 2

I don't see why you would bother. Isn't the key only valid from your domain? IIRC, the only information encoded in it is your domain name, aside from whatever info Google might add such as the time it was generated.