Can your Google Maps API key call Gemini? How to check and lock it down

For years Google told developers that a Maps or Firebase API key isn't a secret. It goes in your web page, anyone can read it, and restrictions keep it safe. Then the same keys started working for Gemini, and a public key that could once only draw maps could run an image model on your bill.

Google has fixed most of this since. This guide covers what happened, what changed, which keys can still reach Gemini, and how to check yours in a few minutes.

What happened

A Google Cloud API key with no API restrictions can call every API enabled in its project that accepts API keys. Google's docs say so plainly: "API keys without API restrictions can be used with all APIs that accept keys generated by Google Cloud" (Google Cloud docs).

That used to mean Maps, Places, maybe Translation. Once Gemini arrived, it meant the Generative Language API too. Enabling Gemini in a project quietly gave every unrestricted key in that project access to it. No warning, no email.

In February 2026 Truffle Security published what that looked like at scale. They scanned the November 2025 Common Crawl, a public copy of a large part of the web, and found 2,863 live Google API keys sitting in web pages that could call Gemini. Some belonged to banks, security companies and Google itself. Besides running up charges, a key like that could read files and cached content the project had uploaded to Gemini.

The bills that followed were large and fast:

• A three-person startup in Mexico was charged $82,314.44 in about 48 hours in February 2026, mostly for Gemini 3 Pro Image and Gemini 3 Pro Text. They normally spent about $180 a month. Google pointed to its shared responsibility model (The Register).
• In April 2026 a developer reported a Firebase browser key, with no API restrictions, being used for Gemini right after they turned on a Gemini feature in the project. The bill passed €54,000 in about 13 hours, and their budget alerts arrived hours late (Google AI developer forum).

What Google changed in 2026

• 7 May 2026. The Gemini API started blocking unrestricted keys that had been dormant for a long time. Google doesn't say how long.
• 28 May 2026. New keys created in Google AI Studio became "auth keys", restricted to the Gemini API by default.
• 19 June 2026. The Gemini API stopped accepting requests from unrestricted standard keys (Google's announcement). Keys with explicit restrictions keep working (Gemini API docs).

The Cloud console and gcloud now also refuse to create a key without at least one API restriction. Keys created through the REST API, which includes most Terraform and scripts, are still unrestricted unless you set restrictions.

So an unrestricted Maps key from 2022 can't call Gemini any more. That doesn't make every key safe.

Which keys can still reach Gemini

• Keys whose API restriction list includes the Generative Language API. The block only covers unrestricted keys. If someone added Gemini to your Maps key's list to get a feature working, that key is restricted, it's public, and it calls Gemini.
• Gemini keys shipped in client code. A key made for Gemini, then put in a web app, a mobile app or a browser extension. Google's own advice: "Keys compiled in client-side code can be extracted by users."
• Unrestricted keys, for everything else. They can't call Gemini now, but they can still call every other enabled API that accepts keys, including the Maps APIs you pay for per request. Google is blunt about who pays: "You are financially responsible for charges caused by abuse of unrestricted API keys" (Maps Platform security guidance).

Check your project in five minutes

Do this for each project that has API keys. Set PROJECT_ID first.

1. Is the Gemini API enabled at all?

gcloud services list --enabled --project=PROJECT_ID | grep generativelanguage

No output means the Generative Language API is off in this project, and no key in it can call Gemini. If you see generativelanguage.googleapis.com, keep going.

In the console, the same list is under APIs & Services > Enabled APIs & services. Look for "Generative Language API".

2. Which keys can call it?

# Every key in the project, with its restrictions.
gcloud services api-keys list --project=PROJECT_ID --format=json

For each key, look at restrictions.apiTargets. A key whose list includes generativelanguage.googleapis.com can call Gemini. A key with no apiTargets at all is unrestricted: it can't call Gemini any more, but it needs restricting anyway (see below).

In the console, APIs & Services > Credentials shows a warning icon next to unrestricted keys. Click a key's name to see its API restrictions.

3. Test a key directly

If you have the key string, ask Gemini to list its models:

curl -s -o /dev/null -w "%{http_code}\n" \
  -H "x-goog-api-key: THE_KEY" \
  "https://generativelanguage.googleapis.com/v1beta/models"

200 means the key reaches Gemini. 403 means it's blocked. Listing models doesn't generate any tokens, which is what Gemini bills for. Send the key in the header, as here, not in the URL: URLs end up in logs and shell history.

4. Look at what each key has been calling

Restrictions show what a key can do. Traffic shows what it has done.

1. Open Monitoring > Metrics explorer.
2. Choose the resource type Consumed API and the metric Request count (serviceruntime.googleapis.com/api/request_count).
3. Filter service to generativelanguage.googleapis.com.
4. Group by credential_id.

Each line is one key. A Gemini line from a key that's meant for Maps is the thing you're looking for. The same view with the service filter removed shows every API a given key calls. Google says new data can take up to 30 minutes to show up here (metric details).

If you find Gemini traffic you can't explain, stop here and work through what to do in the first hour after a key leaks, then the guide to an unexpected Gemini bill.

Lock it down

Restrict the Maps key to Maps

Give the key the exact list of Maps APIs your site calls, and nothing else:

gcloud services api-keys update KEY_ID --project=PROJECT_ID \
  --api-target=service=maps-backend.googleapis.com \
  --api-target=service=places-backend.googleapis.com

maps-backend is the Maps JavaScript API and places-backend is the Places API. Others you may need are geocoding-backend, static-maps-backend and maps-embed-backend, each followed by .googleapis.com (full list).

The flags replace the key's whole list, so name every API it needs. By default the command refuses a change that would cut off an API the key used in the last seven days. If that API is Gemini and you want it gone, that refusal is telling you the key really was calling it. Add --no-check-existing-usage to go ahead.

Add a website restriction

gcloud services api-keys update KEY_ID --project=PROJECT_ID \
  --allowed-referrers="example.com/*,*.example.com/*"

This stops the key working on other people's websites. It doesn't stop a script, which can send any Referer header it wants. The API list is what limits what a stolen key can do.

Turn Gemini off where you don't use it

API restrictions apply to one key. Disabling the API covers every key in the project, including ones you haven't found yet:

gcloud services disable generativelanguage.googleapis.com --project=PROJECT_ID

If the API was used in the last 30 days or enabled in the last 3, add --force.

Give Gemini its own project

Google recommends not sharing a key between Gemini and other APIs (Gemini API docs). Go one step further and keep Gemini in a separate project from your public Maps and Firebase keys. Then no public key can ever be given access to it by accident, and the spend caps below apply only to Gemini.

Cap the spend

• AI Studio project spend cap. On the Spend page in AI Studio, under Monthly spend cap. Google marks it experimental and says spending can run about ten minutes past it (Gemini billing docs).
• Cloud Billing spend cap budget. A budget for one project and the Gemini API that pauses the API once costs pass 100% (spend cap budgets).
• Quotas. APIs & Services > Generative Language API > Quotas. Set requests per day to a little above your real use.

Billing spike alerts and spend caps covers all three, plus the equivalents on OpenAI and Anthropic. To have a key switched off as soon as it starts calling Gemini, see how to automatically revoke an abused API key.

How Keyll handles this

Keyll watches request counts for every key in a project, per key and per API. A Maps key that starts calling Gemini is using a service it never used before, so Keyll alerts you by email and Slack. If the traffic keeps going, it warns you, then restricts that one key, and the project's other keys keep working. One click puts back the exact restrictions the key had. Keyll hasn't launched yet. Join the waitlist to get one email when it does.

Checklist

• Generative Language API disabled in every project that doesn't use Gemini
• No key that ships to browsers or apps lists generativelanguage.googleapis.com
• Every key has API restrictions, and browser keys have website restrictions
• Gemini runs in its own project, with its own key
• Spend cap or quota set on the Gemini project
• Per-key traffic checked in Metrics explorer