How to restrict your Google Maps API key
Google browser keys (they start with AIza) have to be in your page for Maps and similar APIs to work. The protection is restricting what they can do, not hiding them. An unrestricted key can be used on anyone's site, on your bill.
Steps
- Open Google Cloud Console → APIs & Services → Credentials.
- Click your key.
- Under Application restrictions, choose Websites and add your domains, for example
https://yoursite.com/*. - Under API restrictions, choose Restrict key and select only the APIs your site uses.
- Save. Changes can take a few minutes to apply.
Also set a budget alert in Billing, so unexpected usage gets your attention quickly.