2026-11-05 · Daily security tips

Is the Maps key in your frontend locked to your domain?

Not every key in your frontend is a leak. A Google Maps JavaScript key has to be in the browser to work. That also means anyone can copy it from your page and use it on their own site, billed to your Google Cloud project.

Check: search your page source or built JS for AIza. Then open Google Cloud console > APIs & Services > Credentials. If that key is marked unrestricted, or Application restrictions is None, it works from anywhere.

Fix: set Application restrictions to Websites and add your domains, like https://yoursite.com/*. Under API restrictions, allow only the APIs your pages call. Then set a quota and a budget alert, since referrer checks stop other websites but not scripts.

Using Mapbox? Public tokens support URL restrictions too.