Meta tags:
description=Learn best practices for securing your API keys to prevent unauthorized access and unexpected charges.;

Headings (most frequently used words):

api, keys, to, your, and, key, don, in, code, best, practices, for, managing, stay, organized, with, collections, save, categorize, content, based, on, preferences, add, restrictions, avoid, using, query, parameters, provide, google, apis, delete, unneeded, minimize, exposure, attacks, include, client, or, commit, them, repositories, use, authorization, production, implement, strong, monitoring, logging, isolate, rotate, periodically, consider, more, secure, method, of, authorizing, access, products, pricing, support, resources, engage,

Text of the page (most frequently used words):
the (37), api (34), and (29), keys (25), cloud (21), #google (18), key (17), for (16), your (15), gcloud (13), cli (13), using (12), more (10), overview (10), use (9), code (8), can (8), access (8), application (8), authorization (8), resources (7), thumb (7), are (7), account (7), practices (7), authentication (7), authenticate (7), client (7), with (6), see (6), you (6), that (6), credentials (6), service (6), management (6), apis (6), manage (5), information (5), secure (5), best (5), monitoring (5), sdk (5), tools (5), português (4), español (4), down (4), this (4), help (4), usage (4), production (4), managing (4), development (4), libraries (4), samples (3), products (3), other (3), content (3), storage (3), data (3), methods (3), provide (3), each (3), identity (3), migrate (3), gemini (3), security (3), don (3), restrictions (3), guides (3), default (3), environment (3), 한국어 (2), 日本語 (2), עברית (2), brasil (2), italiano (2), indonesia (2), français (2), américa (2), latina (2), deutsch (2), english (2), sign (2), terms (2), site (2), youtube (2), started (2), support (2), pricing (2), understand (2), need (2), last (2), updated (2), 2026 (2), utc (2), licensed (2), under (2), developers (2), policies (2), license (2), send (2), feedback (2), when (2), applications (2), they (2), exposing (2), unauthorized (2), keep (2), implement (2), following (2), method (2), rotate (2), periodically (2), create (2), new (2), delete (2), their (2), own (2), audit (2), impact (2), compromised (2), logging (2), user (2), make (2), sure (2), set (2), requests (2), should (2), possible (2), iam (2), instead (2), theft (2), add (2), query (2), url (2), ways (2), based (2), documentation (2), languages (2), frameworks (2), infrastructure (2), costs (2), observability (2), networking (2), migration (2), industry (2), solutions (2), distributed (2), hybrid (2), multicloud (2), databases (2), analytics (2), pipelines (2), compute (2), hosting (2), configure (2), token (2), get (2), console (2), cross (2), product (2), reference (2), technology (2), areas (2), close (2), subscribe, newsletter, our, third, decade, climate, action, join, cookies, privacy, about, tech, twitter, events, blog, engage, training, certification, architecture, center, getting, github, system, status, release, notes, community, forums, contact, sales, marketplace, all, easy, easytounderstand, solved, problem, solvedmyproblem, otherup, hard, hardtounderstand, incorrect, sample, incorrectinformationorsamplecode, missing, missingtheinformationsamplesineed, otherdown, tell, except, otherwise, noted, page, details, java, registered, trademark, oracle, its, affiliates, apache, creative, commons, attribution, ensure, kept, during, both, transmission, publicly, lead, unexpected, charges, choosing, consider, authorizing, update, old, team, member, control, trail, reduce, isolate, alert, strong, obscure, end, logs, track, actions, individual, users, has, bearer, means, someone, steals, same, sent, alongside, makes, likely, might, exposed, logged, here, why, from, soon, exception, because, doesn, projects, moving, project, into, bound, isn, granted, any, roles, note, such, least, privilege, short, lived, plan, alternatives, designed, accelerate, initial, experience, exploring, most, recommend, environments, hardcoded, source, stored, repository, open, interception, bad, actors, pass, server, which, credential, issue, request, include, commit, them, repositories, retain, only, actively, attack, surface, small, unneeded, minimize, exposure, attacks, providing, parameter, includes, through, scans, library, http, header, goog, avoid, parameters, apply, adding, limit, used, reducing, save, categorize, preferences, stay, organized, collections, developer, home, uninstalling, components, packages, scripting, commands, cheat, sheet, develop, enable, accessibility, features, properties, configurations, behind, proxy, firewall, initialize, cases, reauthentication, step, verification, requirement, types, tokens, troubleshoot, adc, setup, how, works, premises, another, provider, containerized, resource, attached, local, impersonation, rest, homebrew, installer, versioned, archives, snap, package, stable, image, docker, installation, install, explained, discover, start, free, skip, main,

Text of the page (random words):
best practices for managing api keys authentication google cloud documentation skip to main content technology areas close ai and ml application development application hosting compute data analytics and pipelines databases distributed hybrid and multicloud industry solutions migration networking observability and monitoring security storage cross product tools close access and resources management costs and usage management infrastructure as code sdk languages frameworks and tools console english deutsch español español américa latina français indonesia italiano português português brasil עברית 中文 简体 中文 繁體 日本語 한국어 sign in google cloud sdk authentication start free overview guides reference resources technology areas more overview guides reference resources cross product tools more console discover google cloud sdk overview gcloud cli overview cloud client libraries overview client libraries and cloud apis explained get started install the gcloud cli other installation methods using docker overview migrate to the stable image using a snap package using versioned archives using the installer using homebrew authenticate to google cloud authentication methods at google ways to authenticate authenticate for using client libraries authenticate for using rest authenticate by using service account impersonation application default credentials set up application default credentials overview local development environment resource with an attached service account containerized environment on premises or another cloud provider cloud based development environment how application default credentials works troubleshoot your adc setup api keys use api keys to access apis manage api keys best practices for managing api keys get an id token tokens overview token types 2 step verification requirement reauthentication authentication use cases identity management products configure the gcloud cli initialize the gcloud cli authenticate for the gcloud cli configure the gcloud cli for use behind a proxy or firewall manage gcloud cli configurations manage gcloud cli properties enable accessibility features develop gcloud cli cheat sheet scripting gcloud cli commands client libraries best practices manage packages in gcloud cli managing gcloud cli components uninstalling the gcloud cli ai and ml application development application hosting compute data analytics and pipelines databases distributed hybrid and multicloud industry solutions migration networking observability and monitoring security storage access and resources management costs and usage management infrastructure as code sdk languages frameworks and tools home documentation developer tools google cloud sdk authentication guides send feedback best practices for managing api keys stay organized with collections save and categorize content based on your preferences when you use api keys in your applications ensure that they are kept secure during both storage and transmission publicly exposing your api keys can lead to unexpected charges on your account or unauthorized access to your data to help keep your api keys secure implement the following best practices add api key restrictions to your key by adding restrictions you can limit the ways an api key can be used reducing the impact of a compromised api key for more information see apply api key restrictions avoid using query parameters to provide your api key to google apis providing your api key to apis as a query parameter includes your api key in the url exposing your key to theft through url scans use the x goog api key http header or a client library instead delete unneeded api keys to minimize exposure to attacks retain only the api keys you are actively using to keep your attack surface as small as possible don t include api keys in client code or commit them to code repositories api keys hardcoded in the source code or stored in a repository are open to interception or theft by bad actors the client should pass requests to the server which can add the credential and issue the request don t use authorization keys in production authorization keys are designed to accelerate the initial experience for developers exploring google cloud apis for most apis we recommend you don t use authorization keys in production environments instead plan to migrate to more secure alternatives such as identity and access management iam policies and short lived service account credentials following least privilege security practices note the exception is using authorization keys with gemini api in production because gemini api doesn t create resources in google cloud projects when moving a gemini api project into production make sure that the service account the authorization key is bound to isn t granted any iam roles here s why you should migrate from using an authorization key to more secure practices as soon as possible api keys are sent alongside requests this makes it more likely that the key might be exposed or logged api keys are bearer credentials this means that if someone steals an authorization key they can use it to authenticate as that service account and access the same resources that service account can authorization keys obscure the identity of the end user in audit logs to track the actions of individual users make sure each user has their own set of credentials implement strong monitoring and logging monitoring api usage can help alert you to unauthorized usage for more information see cloud monitoring overview and cloud logging overview isolate api keys provide each team member with their own api key for each application this can help control access provide an audit trail and reduce the impact of a compromised api key rotate your api keys periodically periodically create new api keys update your applications to use the new api keys and delete the old keys for more information see rotate an api key consider a more secure method of authorizing access for help with choosing an authentication method see authentication methods send feedback except as otherwise noted the content of this page is licensed under the creative commons attribution 4 0 license and code samples are licensed under the apache 2 0 license for details see the google developers site policies java is a registered trademark of oracle and or its affiliates last updated 2026 07 21 utc need to tell us more easy to understand easytounderstand thumb up solved my problem solvedmyproblem thumb up other otherup thumb up hard to understand hardtounderstand thumb down incorrect information or sample code incorrectinformationorsamplecode thumb down missing the information samples i need missingtheinformationsamplesineed thumb down other otherdown thumb down last updated 2026 07 21 utc products and pricing see all products google cloud pricing google cloud marketplace contact sales support community forums support release notes system status resources github getting started with google cloud code samples cloud architecture center training and certification engage blog events x twitter google cloud on youtube google cloud tech on youtube about google privacy site terms google cloud terms manage cookies our third decade of climate action join us sign up for the google cloud newsletter subscribe english deutsch español español américa latina français indonesia italiano português português brasil עברית 中文 简体 中文 繁體 日本語 한국어