Guides

Guide · Leaked keys and files

Your public Google API key can run up a bill. Lock it to your site and its APIs

A Google key that starts with AIza in your site’s code is normal for Firebase and Google Maps: the browser needs it. It’s only safe when it’s restricted, to your website and to the APIs your app actually uses. Otherwise anyone can copy it and use it on your bill.

Why it matters

In April 2026 a developer reported more than €54,000 of Gemini charges in about 13 hours, made with a Firebase browser key that had no API restrictions. Their request for a billing adjustment was denied (Google AI forum). Two weeks later another reported more than USD 67,000 in about 19 hours, through a key Firebase had created for them in 2016 (Google AI forum). Google’s Maps documentation says you’re financially responsible for charges caused by abuse of unrestricted keys (Google Maps docs).

How a Firebase key ends up able to call Gemini

A key can only call the APIs on its allowed list, and that list can hold more than you think. When Google restricted older Firebase keys in May 2024, it kept every API the project had switched on at the time (Firebase docs). Switch on the Gemini API in the same project later, for a feature or a test, and a public key may be able to use it. Firebase’s advice is plain: the Gemini API, listed as the Generative Language API, should never be on the list for a key that’s in your public code.

Google now says the Gemini API rejects keys with no restrictions at all (Gemini docs). So the risk today is a key whose list includes it, or other paid APIs such as Maps.

The two restrictions

Application restrictions › WebsitesOnly pages on your domains can use the key.Set it
API restrictions › Restrict keyOnly the APIs your app calls, for example the Firebase ones or the Maps JavaScript API.Set it
Generative Language API on a public keyThat’s the Gemini API.Remove it

Google recommends setting both restrictions (Google Cloud docs).

See it yourself

  1. Open your live site, open the developer tools (F12, or right-click › Inspect) and press Ctrl+Shift+F (Cmd+Option+F on a Mac) to search every file the page loaded.
  2. Search for AIza. Each match is a Google key.
  3. In the Google Cloud console, go to APIs & Services › Credentials and open the key with the same first characters.
Application restrictions says NoneWorth fixing
API restrictions says Don’t restrict keyWorth fixing
The allowed APIs include the Generative Language APIFix now
Websites are set to your domains, and only your app’s APIs are allowedClear

Fix it

  1. On the key’s page, under Application restrictions, choose Websites and add your domains, for example yourapp.com/* and www.yourapp.com/*. Add your preview address too if you use it.
  2. Under API restrictions, choose Restrict key and tick only the APIs your app uses. Leave the Generative Language API off. Save.
  3. If you think someone else has used the key, make a new one with these restrictions, put it in your app, then delete the old one.
  4. In Billing › Budgets & alerts, set a budget so Google emails you when costs jump. A budget alert doesn’t stop spending on its own; it tells you in time to act (Google Cloud docs).

Your AI tool can walk you through it. This is the same prompt our checker gives you:

Paste this into Lovable, Bolt, Cursor or Claude Code

My Google API key is in my public code, which is normal for Firebase and Maps, but it must be restricted. Walk me through restricting it in Google Cloud Console to my website’s domains and only the APIs my app uses.

What this can’t tell you

We find Google keys in your page and up to five of its scripts, but we can’t see your Google Cloud settings. So we can’t tell whether a key is restricted: we show every one as Worth fixing, and the check in Google Cloud is yours. Keys used only by your server never reach us, and they’re not the problem here.

Related