Apps shipping a Google API key

What this finding means, and what it does not

A Google API key for Maps, Places or a similar client service is meant to be embedded in the app. Anyone can extract it from an APK in minutes, and that is an accepted property of the design, not a mistake.

This is why this category is near-universal: we record it in 5,526 of the apps we have scanned. A number that large is not an alarm. It is a baseline, and its value is in the exception — a key that has been left unrestricted.

Google's security model for these keys does not rest on the key being secret. It rests on restrictions: an application restriction binding the key to your package name and signing certificate, and an API restriction limiting it to the specific services it needs.

Why an unrestricted key matters

An unrestricted key works for anyone who holds it. Extracted from your APK, it can be used from any app or server, and the usage is billed to your project. Maps and Places calls are not free at volume, and the first sign of a problem is usually an invoice.

Quota is the other half. Even where cost is capped, a key used elsewhere consumes the quota your own users depend on, so the failure mode is your app's maps not loading.

How to fix it

• In Google Cloud Console, add an Android application restriction with your package name and your release signing certificate's SHA-1 fingerprint. Remember to add the Play App Signing certificate, not only your upload key.
• Add an API restriction so the key is accepted only for the APIs it actually calls.
• Use separate keys per platform and per environment, so a key can be rotated without coordinating a release across everything.
• Keep keys for server-side APIs out of the app entirely. Those are not client keys and no restriction makes them safe to ship.
• Check usage in the Cloud Console for traffic that does not match your release pattern.

How we detect it, and what it cannot tell you

The key's format is matched in the APK's resources and compiled code, and the value is recorded in redacted form only — a scheme prefix and a coarse length bucket, never the key itself.

The critical limit is that an APK does not say whether a key is restricted. Restriction lives in your Google Cloud project, which we have no access to and do not attempt to test. We can tell you a key ships; only you can tell whether it is restricted. That is why this is recorded as a signal to check rather than as a confirmed exposure.