|
| 1 | +--- |
| 2 | +title: Secure API Keys |
| 3 | +--- |
| 4 | + |
| 5 | +# Best Practices: Secure API Keys |
| 6 | + |
| 7 | +Google Cloud API key restriction is essential for managing access and enhancing security when |
| 8 | +working with Google Cloud services. This overview explains how to effectively restrict API keys, |
| 9 | +allowing developers to control how and where their keys can be used. Developers can set geographical |
| 10 | +restrictions, bind keys to specific IP addresses, or limit usage to particular services. These |
| 11 | +measures ensure that API keys are secured, helping to protect projects and maintain optimal |
| 12 | +functionality. |
| 13 | + |
| 14 | +To minimize potential damage from compromised API keys: |
| 15 | + |
| 16 | +- **Add restrictions to your API key:** By setting restrictions, you can limit how an API key can be |
| 17 | + used, thus reducing the impact if it becomes compromised. |
| 18 | + |
| 19 | +- **Delete unnecessary API keys:** Remove any API keys that are no longer required to reduce |
| 20 | + exposure to attacks. |
| 21 | + |
| 22 | +- **Rotate your API keys periodically:** Regularly create new API keys, delete the old ones, and |
| 23 | + update your applications to use the new keys. This practice helps maintain security and limit the |
| 24 | + lifespan of any single key. |
| 25 | + |
| 26 | +## Add restrictions to your API key |
| 27 | + |
| 28 | +API keys are unrestricted by default. Unrestricted keys are insecure because they can be used by |
| 29 | +anyone, from anywhere. You can add either [**application restrictions |
| 30 | +**](https://cloud.google.com/docs/authentication/api-keys?#adding-application-restrictions) or [* |
| 31 | +*API restrictions**](https://cloud.google.com/docs/authentication/api-keys?#api_key_restrictions) to |
| 32 | +enhance |
| 33 | +security. |
| 34 | + |
| 35 | +In the following example, we will use the **Map API keys** and restrict them to specific platforms |
| 36 | +using |
| 37 | +their unique identifiers. |
| 38 | + |
| 39 | +At this stage, you should already have API keys created, but they are currently unrestricted. If |
| 40 | +they are not yet created, you can follow the integration process for any of the Google Cloud |
| 41 | +services we support in FlutterFlow, or for Maps, [**you can go here. |
| 42 | +**](../maps/google-maps/generate-maps-keys) |
| 43 | + |
| 44 | +All your created API keys should be available on |
| 45 | +the [Cloud Credentials Page](https://console.cloud.google.com/apis/credentials). (Ensure you are |
| 46 | +logged into the correct Google account and are in the right Google Cloud project.) |
| 47 | + |
| 48 | +Follow the steps below to enable the iOS key exclusively for iOS apps with a unique package name: |
| 49 | + |
| 50 | +<div style={{ |
| 51 | + position: 'relative', |
| 52 | + paddingBottom: 'calc(56.67989417989418% + 41px)', // Keeps the aspect ratio and additional padding |
| 53 | + height: 0, |
| 54 | + width: '100%' |
| 55 | +}}> |
| 56 | + <iframe |
| 57 | + src="https://demo.arcade.software/givOcppDSZHXzWJDloWj?embed&show_copy_link=true" |
| 58 | + title="Restrict API Keys" |
| 59 | + style={{ |
| 60 | + position: 'absolute', |
| 61 | + top: 0, |
| 62 | + left: 0, |
| 63 | + width: '100%', |
| 64 | + height: '100%', |
| 65 | + colorScheme: 'light' |
| 66 | + }} |
| 67 | + frameborder="0" |
| 68 | + loading="lazy" |
| 69 | + webkitAllowFullScreen |
| 70 | + mozAllowFullScreen |
| 71 | + allowFullScreen |
| 72 | + allow="clipboard-write"> |
| 73 | + </iframe> |
| 74 | +</div> |
| 75 | + |
| 76 | +Now your iOS API Key will only work when accessed from your app with the given unique identifier. |
| 77 | +You can also restrict the API keys by **HTTP referrers** or **IP addresses**. Here's a quick |
| 78 | +overview from the official docs: |
| 79 | + |
| 80 | + |
| 81 | + |
| 82 | +:::note[Learn More] |
| 83 | +Learn more about **securing API keys for all platforms and restricting API usage** by visiting |
| 84 | +the official [**Google Cloud Docs**](https://cloud.google.com/docs/authentication/api-keys?#securing). |
| 85 | +::: |
0 commit comments