updated maps configuration

Author: christophdb

docs/assets/images/maps-dtable-key.png

@@ -50,18 +50,21 @@ Typically, plugins do not necessitate additional configuration. However, there a
 
 ### Map Plugin
 
-The Map plugin exclusively supports the Google Maps Platform. To enable access to Google Maps data, two <a href="https://developers.google.com/maps/documentation/javascript/get-api-key?hl=en">Google API Keys</a> are required.
+The Map plugin works exclusively with the Google Maps Platform. To enable it, you need two <a href="https://developers.google.com/maps/documentation/javascript/get-api-key?hl=en">Google API keys</a>, each with different permissions:
 
-![Create Google Maps API key](../assets/images/google-maps-api.png)
+- Geocoding API
+- Maps Javascript API
 
-Generate two API keys and append the following lines to the configuration file `dtable_web_settings.py`.
+Using two separate keys is recommended for security and cost control. While technically the same key could be used for both, separating them ensures that your Geocoding API key (which is expensive) is not exposed to end users.
 
 ```bash
-DTABLE_GOOGLE_MAP_KEY = '<replace with your Google Maps API Key>'
-SERVER_GOOGLE_MAP_KEY = '<replace with your Google Maps API Key>'
+DTABLE_GOOGLE_MAP_KEY = '<your Maps JavaScript API key here>'
+SERVER_GOOGLE_MAP_KEY = '<your Geocoding API key here>'
 ```
 
-!!! warning "Required scope of the API keys"
+![Create two API keys for Google Maps](../assets/images/maps-requires-two-google-keys.png)
+
+!!! danger "Required scope of the API keys"
 
     To safeguard your Google API Keys from abuse, restrict their usage. However, even with restrictions in place, abuse remains a risk—especially since `DTABLE_GOOGLE_MAP_KEY` must be included in your source code and is therefore publicly accessible. Additionally, heavy use of the maps plugin may increase your Google billing, so monitor your spending closely.
 
@@ -70,9 +73,25 @@ SERVER_GOOGLE_MAP_KEY = '<replace with your Google Maps API Key>'
     | `DTABLE_GOOGLE_MAP_KEY` | Restrict to your Server URL,<br>like `https://cloud.seatable.io` | Maps Javascript API |
     | `SERVER_GOOGLE_MAP_KEY` | **No website restriction** | Geocoding API | 
 
-Remember to [restart the SeaTable Service](../maintenance/restart-seatable.md) to apply the changes from the updated configuration file.
 
-![The required API key permissions](../assets/images/maps-plugin-api-keys.png)
+#### `SERVER_GOOGLE_MAP_KEY`
+
+- Used for **server-side requests** (Geocoding API).  
+- **Do not** restrict it to a website (since requests originate from the server).  
+- Restrict it instead by **API usage** → only allow the *Geocoding API*.  
+
+![Permissions for SERVER_GOOGLE_MAP_KEY](../assets/images/maps-server-key.png)
+
+#### `DTABLE_GOOGLE_MAP_KEY`
+
+- Used for **client-side requests** (Maps JavaScript API).  
+- This key must be embedded in the frontend and will therefore be **publicly visible**.  
+- Restrict it to your **SeaTable server’s domain** (HTTP referrers).  
+- Allow usage only for the *Maps JavaScript API*.  
+
+![Permissions for DTABLE_GOOGLE_MAP_KEY](../assets/images/maps-dtable-key.png)
+
+Remember to [restart the SeaTable Service](../maintenance/restart-seatable.md) to apply the changes from the updated configuration file.
 
 ### Whiteboard Plugin
 

docs/assets/images/maps-requires-two-google-keys.png

@@ -139,7 +139,7 @@ Of course, you can skip this script and make the changes manually. The following
 
 ??? info "Maps Plugin utilizes two API Keys"
 
-    The Google Maps Plugin now uses two separate Google API keys instead of one. Please refer to the [documentation for further details](../configuration/plugins.md).
+    The Google Maps Plugin now uses two separate Google API keys instead of one. Please refer to the [documentation for further details](../configuration/plugins.md#map-plugin).
 
 ## 5.2