Protect your API keys

Last updated: September 20, 2026

Your API key gives access to your quota. Follow these rules to keep it safe.

Rules

  • Store the key in an environment variable or a secrets manager.
  • Do not put the key in source control.
  • Do not put the key in browser code or mobile applications.
  • Make one key for each environment. For example, development, staging, and production.
  • Make one key for each service that uses the API.
  • Revoke keys that you do not use.

If a key is exposed

  1. Create a new key.
  2. Change your application to use the new key.
  3. Revoke the exposed key.

See Rename, revoke, and rotate API keys.