Home / Fix guides / Google API key in client code
Google API key (AIza) in your front end: restrict it
Low
A Google API key (AIza…) is in your client code. Firebase web keys are public by design; keys for paid APIs (Gemini/AI Studio, Maps, Places) can be abused unless restricted.
Why it matters
An unrestricted key for a paid Google API can be used by anyone on their own sites, billed to you.
Quick fix
- Google Cloud Console → APIs & Services → Credentials: add HTTP referrer restrictions and limit the key to the APIs it needs.
- Never call Gemini directly from the browser with an AI Studio key; proxy it server-side.
Step by step
Restrict the key
Google Cloud Console → APIs & Services → Credentials → the key → Application restrictions: Websites (your domains) and API restrictions: only the APIs used.
Prompt for your AI builder
Paste this into Lovable, Bolt, v0, Cursor or Replit, then review the changes before deploying.
Check which Google API each AIza key in my front-end code is used for. For Firebase keys, leave them. For Gemini/AI keys, move the calls server-side. For Maps keys, document the HTTP referrer and API restrictions I should set in Google Cloud Console.