Google Maps: Platform rejected your request. This I[...] site or [...] is not authorized to use this API key

Question

<iframe width="100%" height="427" frameborder="0" style="border:0" src="https://www.google.com/maps/embed/v1/place?q=place_id:[place_id]&key=[my_key]" allowfullscreen></iframe>

"Google Maps Platform rejected your request. This IP, site or mobile application is not authorized to use this API key. Request received from IP address xxx.xxx.xxx.xxx, with referer: https://xxx.xxx/"

In Google Dev I have enabled Maps Embed API and also Maps Static API. I have limited the key to work with my domain only, where the above code is included, like https://[asterisk].thedomain.com/[asterisk].

The map embed works and does not throw an error, when I do NOT limit the key to this single domain.

The issue is, that the key is plain readable in the code and thus I need to limit the key to my domain.

Any ideas?

Thank you.

Solution 1

Make sure you have "Maps Embeded API" added to the key restrictions / api restriction section of the API Key you are using.

Solution 2

My site in question is delivered like https://thedomain.com/.

Google Maps Platform does make a difference between https://www.thedomain.com/ and https://thedomain.com/.

Limiting my API to https://thedomain.com/* worked for me, while https://*.thedomain.com/* does not imply * to be nothing.

Solution 3

If you check the example google gives, it as an error in it. It should be : http://*example.com/* and NOT http://*.example.com/* because of the dot it won't work if you don't have something before your domain name like www.

http://example.com won't work simply because it doesn't have a . between // and example.

Comments

[Thommy Tomka]

This was not necessary in my case. It was sufficient to have the Google Maps JS API included in the list of allowed APIs. The trick did, what I explained above, though it is not logical taking into account we usually expect * to be either no, 1 or multiple characters.