Google API keys and Gemini: lock them down now
Google AIza keys used for Maps or Firebase can start working for Gemini. How to restrict every key in about 10 minutes, and when to rotate.
What changed
For years Google said keys that start with AIza (Maps, Firebase and so on) were fine to put in your website. Then Gemini started accepting the same keys. When someone enables the Gemini (Generative Language) API on a Google Cloud project, existing keys in that project can quietly start working for Gemini. You get "no warning", "no confirmation dialog" and "no email notification" (Truffle Security).
Researchers found about 2,800 public keys that could access Gemini, including some of Google's own (Malwarebytes). With such a key, an attacker can access files you uploaded to Gemini and run up your AI bill (Truffle Security).
Google's current rules
- A Firebase key is fine to expose only if it is restricted to Firebase APIs. "Never include the Gemini Developer API in the allowlist for a publicly accessible API key" (Firebase docs).
- Since 28 May 2026, new AI Studio keys are "auth keys" tied to a service account. The Gemini API rejects unrestricted standard keys (Gemini API key docs).
- Never put a Gemini key in web or mobile app code. Call Gemini from a backend instead (Gemini API key docs).
What to do (about 10 minutes)
- Open Google Cloud Console → APIs & Services → Credentials for each project.
- For each key, set API restrictions so only the APIs it needs (Maps, Firebase and so on) are allowed, and make sure Generative Language API is not on the list (Google Cloud blog).
- Add Application restrictions (your website's domain) where you can.
- If you use Gemini, create a separate key, keep it in a server-side secret (an Edge Function or API route) and never in a
VITE_orNEXT_PUBLIC_variable. - If a key with Gemini access was ever in your public code, rotate it. Start with your oldest keys (Truffle Security).
Scan your app free
ShipLatch checks your live site for leaked keys, public env values, source maps and exposed files. The $29 Fix Pack gives you fix prompts written for your app and re-scans that prove each fix worked.
Want the whole pre-launch process in one place? Get App Security for Vibe Coders, our $9 PDF playbook.