0

I have a web application that requires user location.

I am using the Google GeoLocation API. Because this API returns the GeoLocation of the caller, I must call from the client side, which means I must give the client my API key. Obviously this opens me and my API key to potential abuse.

It would be ideal to have the backend make the actual call to the GeoLocation API, but I don't understand how that could be done, given the nature of the GeoLocation API.

Therefore, is there a way around this that would allow me conceal my Google API key, yet still allow the client to submit the request to the GeoLocation API?

Garrett Badeau
  • 338
  • 4
  • 8
  • It *may* not be something to worry about - see https://stackoverflow.com/a/2256487, but I'm not sure – CertainPerformance Jan 10 '21 at 19:51
  • You may leverage [`navigator.geolocation`](https://developer.mozilla.org/en-US/docs/Web/API/Navigator/geolocation) to request client's location or use client's IP address together with [some API](https://ipstack.com/) to convert that into location and then further approximate long, lat pair. So, you're certainly not constrained to the client-side only. – Yevhen Horbunkov Jan 10 '21 at 19:51

2 Answers2

0

You should whitelist your website domain for your production key so that it can only be called on your website.

Also setup API key restriction to only Map JavaScript API.

It can be done under credential tab of APIs and Services in your GCP console.

Ira
  • 11
  • 3
0

The solution is simple - don't use an API key. Rather, use a Client ID - it allows you to restrict data from a specified URL only. Or rather, you have to specify domains, or it doesn't work (as in you can't just create it and use it without specifying a domain).

Endothermic_Dragon
  • 1,147
  • 3
  • 13