Tại sao file google service thiếu api key

These instructions apply for non Google Cloud Platform (GCP) APIs. If you're building a GCP application, see using API keys for GCP.

If your client application does not use OAuth 2.0, then it must include an API key when it calls an API that's enabled within a Google Cloud Platform project. The application passes this key into all API requests as a key=API_key parameter.

To create your application's API key:

1. Go to the API Console.
2. From the projects list, select a project or create a new one.
3. If the APIs & services page isn't already open, open the left side menu and select APIs & services.
4. On the left, choose Credentials.
5. Click Create credentials and then select API key.

Note: In addition to reading the instructions on this page, be sure to read Best practices for securely using API keys.

This page provides background information on API keys and authentication: how each of these are used, the differences between them, and the scenarios where you should consider using API keys.

API keys are for projects, authentication is for users

Cloud Endpoints handles both API keys and authentication schemes, such as Firebase or Auth0. The main distinction between these two is:

• API keys identify the calling project — the application or site — making the call to an API.

• Authentication tokens identify a user — the person — that is using the app or site.

  

API keys provide project authorization

To decide which scheme is most appropriate, it's important to understand what API keys and authentication can provide.

API keys provide

• Project identification — Identify the application or the project that's making a call to this API

• Project authorization — Check whether the calling application has been granted access to call the API and has enabled the API in their project

API keys aren't as secure as authentication tokens (see Security of API keys), but they identify the application or project that's calling an API. They are generated on the project making the call, and you can restrict their use to an environment such as an IP address range, or an Android or iOS app.

By identifying the calling project, you can use API keys to associate usage information with that project. API keys allow the Extensible Service Proxy (ESP) to reject calls from projects that haven't been granted access or enabled in the API.

Authentication of users

By contrast, authentication schemes typically serve two purposes:

• User authentication — Securely verify that the calling user is who they claim to be.

• User authorization — Check whether the user should have access to make this request.

Authentication schemes provide a secure way of identifying the calling user. Endpoints also checks the authentication token to verify that it has permission to call an API. Based on that authentication, the API server decides on authorizing a request.

If you need the ability to identify the user making the call, see Authenticating users.

While API keys identify the calling project, they don't identify the calling user. For instance, if you have created an application that is calling an API, an API key can identify the application that is making the call, but not the identity of the person who is using the application.

If you need a more secure way to limit which projects or services can call your API, see Authentication between services.

Security of API keys

API keys are generally not considered secure; they are typically accessible to clients, making it easy for someone to steal an API key. Once the key is stolen, it has no expiration, so it may be used indefinitely, unless the project owner revokes or regenerates the key. While the restrictions you can set on an API key mitigate this, there are better approaches for authorization.

For examples, see Authenticating users.

When to use API keys

An API may restrict some or all of its methods to require API keys. It makes sense to do this if:

• You do want to block anonymous traffic. API keys identify an application's traffic for the API producer, in case the application developer needs to work with the API producer to debug an issue or show their application's usage.

• You want to control the number of calls made to your API.

• You want to identify usage patterns in your API's traffic. You can see application usage in APIs & services.

  This page describes how to use API keys to authenticate to Google Cloud APIs and services that support API keys.

  Most Google Cloud APIs don't support API keys. Check that the API that you want to use supports API keys before using this authentication method.

  For information about using API keys to authenticate to Google Maps Platform, see the Google Maps Platform documentation. For more information about the API Keys API, see the API Keys API documentation.

  Introduction to API keys

  When you use an API key to authenticate to an API, the API key does not identify a principal, nor does it provide any authorization information. The API key associates the request with a Google Cloud project for billing and quota purposes. Because API keys do not identify the caller, they are often used for accessing public data or resources.

  Many Google Cloud APIs do not accept API keys for authentication. Review the authentication documentation for the service or API that you want to use to determine whether it supports API keys.

  An API key has the following components, which you use to manage and use the key:

  StringThe API key string is an encrypted string, for example,

  POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY2. When you use an API key to authenticate, you always use the key's string. API keys do not have an associated JSON file.IDThe API key ID is used by Google Cloud administrative tools to uniquely identify the key. The key ID cannot be used to authenticate. The key ID can be found in the URL of the key's edit page in the Google Cloud console. You can also get the key ID by using the Google Cloud CLI to list the keys in your project.Display nameThe display name is an optional, descriptive name for the key, which you can set when you create or update the key.

  To manage API keys, you must have the API Keys Admin role (

  POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY3) on the project.

  Create an API key

  To create an API key, use one of the following options:

  Console

  1. In the Google Cloud console, go to the Credentials page:

     Go to Credentials

  2. Click Create credentials, then select API key from the menu.

     The API key created dialog displays the string for your newly created key.

  gcloud

  You use the gcloud alpha services api-keys create command to create an API key.

  Replace

  POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY4 with a descriptive name for your key.

  gcloud alpha services api-keys create --display-name=DISPLAY_NAME

  REST

  You use the keys.create method to create an API key. This request returns a long-running operation; you must poll the operation to get the information for the new key.

  Replace the following values:

  • POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY4: Optional. A descriptive name for your key.

  • POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY6: Your Google Cloud project ID or name.

  curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d {'"displayName" : "DISPLAY_NAME"'} \ "https://apikeys.googleapis.com/v2/projects/PROJECT/locations/global/keys"

  For more information about creating API keys using the REST API, see Creating an API key in the API Key API documentation.

  Copy your key string and keep it secure. Unless you're using a testing key that you intend to delete later, add application and API key restrictions.

  Use an API key

  You can use API keys with REST requests and with client libraries that support them.

  Using an API key with REST

  You can pass the API key into a REST API call as a query parameter with the following format. Replace

  POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY7 with the key string of your API key.

  For example, to pass an API key for a Cloud Natural Language API request for

  POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY8:

  POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY

  Alternatively, you can use the

  POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY9 header to pass in your key. This header must be used with gRPC requests.

  curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "X-goog-api-key: API_KEY" \ -H "Content-Type: application/json; charset=utf-8" \ -d @request.json \ "https://translation.googleapis.com/language/translate/v2"

  Using an API key with client libraries

  When a service's API supports API keys, the client library for that service usually supports API keys. Check the client library documentation to see if the client creation method accepts an API key.

  Secure an API key

  When you use API keys in your applications, ensure that they are kept secure during both storage and transmission. Publicly exposing your API keys can lead to unexpected charges on your account. To help keep your API keys secure, follow these best practices:

  • Add API key restrictions to your key.

    By adding restrictions, you can limit the ways an API key can be used, reducing the impact of a compromised API key.

  • Delete unneeded API keys to minimize exposure to attacks.

  • Recreate your API keys periodically.

    Periodically create new API keys, delete the old keys, and update your applications to use the new API keys.

  Apply API key restrictions

  API keys are unrestricted by default. Unrestricted keys are insecure because they can be used by anyone from anywhere. For production applications, you should set both application restrictions and API restrictions.

  Add application restrictions

  Application restrictions specify which websites, IP addresses, or apps can use an API key.

  You can apply only one application restriction type at a time. Choose the restriction type based on your application type:

  OptionApplication typeNotesHTTP referrersWeb applicationsSpecifies the websites that can use the key.IP AddressesApplications called by specific serversSpecifies the servers or cron jobs that can use the key.Android appsAndroid applicationsSpecifies the Android application that can use the key.iOS appsiOS applicationsSpecifies the iOS bundles that can use the key.

  HTTP referrers

  To restrict the websites that can use your API key, you add one or more HTTP referrer restrictions.

  You can substitute a wildcard character (

  curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "X-goog-api-key: API_KEY" \ -H "Content-Type: application/json; charset=utf-8" \ -d @request.json \ "https://translation.googleapis.com/language/translate/v2" 0) for the subdomain or the path, but you cannot insert a wildcard character into the middle of the URL. For example,

  curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "X-goog-api-key: API_KEY" \ -H "Content-Type: application/json; charset=utf-8" \ -d @request.json \ "https://translation.googleapis.com/language/translate/v2" 1 is valid, and accepts all sites ending in

  curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "X-goog-api-key: API_KEY" \ -H "Content-Type: application/json; charset=utf-8" \ -d @request.json \ "https://translation.googleapis.com/language/translate/v2" 2. However,

  curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "X-goog-api-key: API_KEY" \ -H "Content-Type: application/json; charset=utf-8" \ -d @request.json \ "https://translation.googleapis.com/language/translate/v2" 3 is not a valid restriction.

  Port numbers can be included in HTTP referrer restrictions. If you include a port number, then only requests using that port are matched. If you do not specify a port number, then requests from any port number are matched.

  You can add up to 1200 HTTP referrers to an API key.

  The following table shows some example scenarios and browser restrictions:

  ScenarioRestrictionsAllow a specific URLAdd a URL with an exact path. For example:
  

  curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "X-goog-api-key: API_KEY" \ -H "Content-Type: application/json; charset=utf-8" \ -d @request.json \ "https://translation.googleapis.com/language/translate/v2" 4
  

  curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "X-goog-api-key: API_KEY" \ -H "Content-Type: application/json; charset=utf-8" \ -d @request.json \ "https://translation.googleapis.com/language/translate/v2" 5
  Allow any URL in your siteYou must set two URLs in the

  curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "X-goog-api-key: API_KEY" \ -H "Content-Type: application/json; charset=utf-8" \ -d @request.json \ "https://translation.googleapis.com/language/translate/v2" 6 list.
  

  1. URL for the domain, without a subdomain, and with a wildcard for the path. For example:
     

     curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "X-goog-api-key: API_KEY" \ -H "Content-Type: application/json; charset=utf-8" \ -d @request.json \ "https://translation.googleapis.com/language/translate/v2" 7

  2. A second URL that includes a wildcard for the subdomain and a wildcard for the path. For example:
     

     curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "X-goog-api-key: API_KEY" \ -H "Content-Type: application/json; charset=utf-8" \ -d @request.json \ "https://translation.googleapis.com/language/translate/v2" 8

  Allow any URL in a single subdomain or naked domain

  You must set two URLs in the

  curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "X-goog-api-key: API_KEY" \ -H "Content-Type: application/json; charset=utf-8" \ -d @request.json \ "https://translation.googleapis.com/language/translate/v2" 6 list to allow an entire domain:

  1. URL for the domain, without a trailing slash. For example:
     

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 0
     

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 1
     

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 2
     

  2. A second URL for the domain that includes a wildcard for the path. For example:
     

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 3
     

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 4
     

     curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "X-goog-api-key: API_KEY" \ -H "Content-Type: application/json; charset=utf-8" \ -d @request.json \ "https://translation.googleapis.com/language/translate/v2" 7

  To restrict your API key to specific websites, use one of the following options:

  Console

  1. In the Google Cloud console, go to the Credentials page:

     Go to Credentials

  2. Click the name of the API key that you want to restrict.

  3. In the Application restrictions section, select HTTP referrers.

  4. For each restriction that you want to add, click Add an item, enter the restriction, and click Done.

  5. Click Save to save your changes and return to the API key list.

  gcloud

  1. Get the ID of the key that you want to restrict.

     The ID is not the same as the display name or the key string. You can get the ID by using the

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 6 command to list the keys in your project.

  2. Use the

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 7 command to add HTTP referrer restrictions to an API key.

     Replace the following values:

     • gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 8: The ID of the key that you want to restrict.

     • gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 9: Your HTTP referrer restriction.

       You can add as many restrictions as needed; use commas to separate the restrictions. You must provide all referrer restrictions with the update command; the referrer restrictions provided replace any existing referrer restrictions on the key.

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1"

  REST

  1. Get the ID of the key that you want to restrict.

     The ID is not the same as the display name or the key string. You can get the ID by using the keys.list method. The ID is listed in the

     curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/" 0 field of the response.

     Replace

     POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY6 with your Google Cloud project ID or name.

     curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/"

  2. Use the keys.patch method to add HTTP referrer restrictions to the API key.

     This request returns a long-running operation; you must poll the operation to know when the operation completes and get the operation status.

     Replace the following values:

     • gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 9: Your HTTP referrer restriction.

       You can add as many restrictions as needed; use commas to separate the restrictions. You must provide all referrer restrictions with the request; the referrer restrictions provided replace any existing referrer restrictions on the key.

     • POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY6: Your Google Cloud project ID or name.

     • gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 8: The ID of the key that you want to restrict.

     curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "browserKeyRestrictions": { "allowedReferrers": ["ALLOWED_REFERRER_1"] } } }' \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/KEY_ID?updateMask=restrictions"

  For more information about adding HTTP referrer restrictions to a key using the REST API, see Adding browser restrictions in the API Key API documentation.

  IP Addresses

  You can specify one or more IP addresses of the callers, such as a web server or cron job, that are allowed to use your API key. You can specify the IP addresses in any of the following formats:

  • IPv4 (

    curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/" 5)

  • IPv6 (

    curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/" 6)

  • A subnet using CIDR notation (

    curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/" 7,

    curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/" 8)

  Using

  curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/" 9 is not supported for server restrictions.

  To restrict your API key to specific IP addresses, use one of the following options:

  Console

  1. In the Google Cloud console, go to the Credentials page:

     Go to Credentials

  2. Click the name of the API key that you want to restrict.

  3. In the Application restrictions section, select IP addresses.

  4. For each IP address that you want to add, click Add an item, enter the address, and click Done.

  5. Click Save to save your changes and return to the API key list.

  gcloud

  1. Get the ID of the key that you want to restrict.

     The ID is not the same as the display name or the key string. You can get the ID by using the

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 6 command to list the keys in your project.

  2. Use the

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 7 command to add server (IP address) restrictions to an API key.

     Replace the following values:

     • gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 8: The ID of the key that you want to restrict.

     • curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "browserKeyRestrictions": { "allowedReferrers": ["ALLOWED_REFERRER_1"] } } }' \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/KEY_ID?updateMask=restrictions" 3: Your allowed IP address.

       You can add as many IP addresses as needed; use commas to separate the addresses.

     gcloud alpha services api-keys update KEY_ID \ --allowed-ips="ALLOWED_IP_ADDR_1"

  REST

  1. Get the ID of the key that you want to restrict.

     The ID is not the same as the display name or the key string. You can get the ID by using the keys.list method. The ID is listed in the

     curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/" 0 field of the response.

     Replace

     POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY6 with your Google Cloud project ID or name.

     curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/"

  2. Use the keys.patch method to add server (IP address) restrictions to an API key.

     This request returns a long-running operation; you must poll the operation to know when the operation completes and get the operation status.

     Replace the following values:

     • curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "browserKeyRestrictions": { "allowedReferrers": ["ALLOWED_REFERRER_1"] } } }' \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/KEY_ID?updateMask=restrictions" 3: Your allowed IP address.

       You can add as many IP addresses as needed; use commas to separate the restrictions. You must provide all IP addresses with the request; the referrer restrictions provided replace any existing IP address restrictions on the key.

     • POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY6: Your Google Cloud project ID or name.

     • gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 8: The ID of the key that you want to restrict.

     curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "serverKeyRestrictions": { "allowedIps": ["ALLOWED_IP_ADDR_1"] } } }' \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/KEY_ID?updateMask=restrictions"

  For more information about adding IP address restrictions to a key using the REST API, see Adding server restrictions in the API Key API documentation.

  Android apps

  You can restrict usage of an API key to specific Android apps. You must provide the package name and the 20-byte SHA-1 certificate fingerprint for each app.

  To restrict your API key to one or more Android apps, use one of the following options:

  Console

  1. In the Google Cloud console, go to the Credentials page:

     Go to Credentials

  2. Click the name of the API key that you want to restrict.

  3. In the Application restrictions section, select Android apps.

  4. For each Android app that you want to add, click Add an item and enter the package name and SHA-1 certificate fingerprint, then click Done.

  5. Click Save to save your changes and return to the API key list.

  gcloud

  1. Get the ID of the key that you want to restrict.

     The ID is not the same as the display name or the key string. You can get the ID by using the

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 6 command to list the keys in your project.

  2. Use the

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 7 command to specify the Android apps that can use an API key.

     Replace the following values:

     • gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 8: The ID of the key that you want to restrict.

     • gcloud alpha services api-keys update KEY_ID \ --allowed-ips="ALLOWED_IP_ADDR_1" 2 and

       gcloud alpha services api-keys update KEY_ID \ --allowed-ips="ALLOWED_IP_ADDR_1" 3: The app information for an Android app that can use the key.

       You can add as many apps as needed; use additional

       gcloud alpha services api-keys update KEY_ID \ --allowed-ips="ALLOWED_IP_ADDR_1" 4 flags.

     curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d {'"displayName" : "DISPLAY_NAME"'} \ "https://apikeys.googleapis.com/v2/projects/PROJECT/locations/global/keys" 0

  REST

  1. Get the ID of the key that you want to restrict.

     The ID is not the same as the display name or the key string. You can get the ID by using the keys.list method. The ID is listed in the

     curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/" 0 field of the response.

     Replace

     POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY6 with your Google Cloud project ID or name.

     curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/"

  2. Use the keys.patch method to specify the Android apps that can use an API key.

     This request returns a long-running operation; you must poll the operation to know when the operation completes and get the operation status.

     Replace the following values:

     • gcloud alpha services api-keys update KEY_ID \ --allowed-ips="ALLOWED_IP_ADDR_1" 7 and PACKAGE_NAME_1: The app information for an Android app that can use the key.

       You can add the information for as many apps as needed; use commas to separate the AndroidApplication objects. You must provide all applications with the request; the applications provided replace any existing allowed applications on the key.

     • POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY6: Your Google Cloud project ID or name.

     • gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 8: The ID of the key that you want to restrict.

     curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d {'"displayName" : "DISPLAY_NAME"'} \ "https://apikeys.googleapis.com/v2/projects/PROJECT/locations/global/keys" 2

  For more information about adding Android app restrictions to a key using the REST API, see Adding Android restrictions in the API Key API documentation.

  iOS apps

  You can restrict usage of an API key to specific iOS apps by providing the bundle ID of each app.

  To restrict your API key to one or more iOS apps, use one of the following options:

  Console

  1. In the Google Cloud console, go to the Credentials page:

     Go to Credentials

  2. Click the name of the API key that you want to restrict.

  3. In the Application restrictions section, select iOS apps.

  4. For each iOS app that you want to add, click Add an item and enter the bundle ID, then click Done.

  5. Click Save to save your changes and return to the API key list.

  gcloud

  1. Get the ID of the key that you want to restrict.

     The ID is not the same as the display name or the key string. You can get the ID by using the

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 6 command to list the keys in your project.

  2. Use the

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 7 method to specify the iOS apps that can use the key.

     Replace the following values:

     • gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 8: The ID of the key that you want to restrict.

     • curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/" 3: The bundle ID of an iOS app that you want to be able to use this API key.

       You can add as many bundle IDs as needed; use commas to separate the IDs.

     curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d {'"displayName" : "DISPLAY_NAME"'} \ "https://apikeys.googleapis.com/v2/projects/PROJECT/locations/global/keys" 3

  REST

  1. Get the ID of the key that you want to restrict.

     The ID is not the same as the display name or the key string. You can get the ID by using the keys.list method. The ID is listed in the

     curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/" 0 field of the response.

     Replace

     POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY6 with your Google Cloud project ID or name.

     curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/"

  2. Use the keys.patch method to specify the iOS apps that can use an API key.

     This request returns a long-running operation; you must poll the operation to know when the operation completes and get the operation status.

     Replace the following values:

     • curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/" 3: The bundle ID of an iOS app that can use the key.

       You can add the information for as many apps as needed; use commas to separate the bundle IDs. You must provide all bundle IDs with the request; the bundle IDs provided replace any existing allowed applications on the key.

     • POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY6: Your Google Cloud project ID or name.

     • gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 8: The ID of the key that you want to restrict.

     curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d {'"displayName" : "DISPLAY_NAME"'} \ "https://apikeys.googleapis.com/v2/projects/PROJECT/locations/global/keys" 5

  For more information about adding iOS app restrictions to a key using the REST API, see Adding iOS restrictions in the API Key API documentation.

  Add API restrictions

  API restrictions specify which APIs can be called using the API key.

  Note: Before you can specify an API for an API restriction, the API must be enabled for your project. To enable an API, go to the API dashboard.

  To add API restrictions, use one of the following options:

  Console

  1. In the Google Cloud console, go to the Credentials page:

     Go to Credentials

  2. Click the name of the API key that you want to restrict.

  3. In the API restrictions section, click Restrict key.

  4. Select all APIs that your API key will be used to access.

  5. Click Save to save your changes and return to the API key list.

  gcloud

  1. Get the ID of the key that you want to restrict.

     The ID is not the same as the display name or the key string. You can get the ID by using the

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 6 command to list the keys in your project.

  2. Use the

     gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 7 command to specify which services an API key can be used to authenticate to.

     Replace the following values:

     • gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 8: The ID of the key that you want to restrict.

     • curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "serverKeyRestrictions": { "allowedIps": ["ALLOWED_IP_ADDR_1"] } } }' \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/KEY_ID?updateMask=restrictions" 2,

       curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "serverKeyRestrictions": { "allowedIps": ["ALLOWED_IP_ADDR_1"] } } }' \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/KEY_ID?updateMask=restrictions" 3...: The service names of the APIs that the key can be used to access.

       You must provide all service names with the update command; the service names provided replace any existing services on the key.

     You can find the service name by searching for the API on the API dashboard. Service names are strings like

     curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "serverKeyRestrictions": { "allowedIps": ["ALLOWED_IP_ADDR_1"] } } }' \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/KEY_ID?updateMask=restrictions" 4.

     curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d {'"displayName" : "DISPLAY_NAME"'} \ "https://apikeys.googleapis.com/v2/projects/PROJECT/locations/global/keys" 6

  REST

  1. Get the ID of the key that you want to restrict.

     The ID is not the same as the display name or the key string. You can get the ID by using the keys.list method. The ID is listed in the

     curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/" 0 field of the response.

     Replace

     POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY6 with your Google Cloud project ID or name.

     curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/"

  2. Use the keys.patch method to specify which services an API key can be used to authenticate to.

     This request returns a long-running operation; you must poll the operation to know when the operation completes and get the operation status.

     Replace the following values:

     • curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "serverKeyRestrictions": { "allowedIps": ["ALLOWED_IP_ADDR_1"] } } }' \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/KEY_ID?updateMask=restrictions" 2,

       curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "serverKeyRestrictions": { "allowedIps": ["ALLOWED_IP_ADDR_1"] } } }' \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/KEY_ID?updateMask=restrictions" 3...: The service names of the APIs that the key can be used to access.

       You must provide all service names with the request; the service names provided replace any existing services on the key.

       You can find the service name by searching for the API on the API dashboard. Service names are strings like

       curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "serverKeyRestrictions": { "allowedIps": ["ALLOWED_IP_ADDR_1"] } } }' \ "https://apikeys.googleapis.com/v2/projects/PROJECT_ID/locations/global/keys/KEY_ID?updateMask=restrictions" 4.

     • POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY6: Your Google Cloud project ID or name.

     • gcloud alpha services api-keys update KEY_ID \ --allowed-referrers="ALLOWED_REFERRER_1" 8: The ID of the key that you want to restrict.

     curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d {'"displayName" : "DISPLAY_NAME"'} \ "https://apikeys.googleapis.com/v2/projects/PROJECT/locations/global/keys" 8

  For more information about adding API restrictions to a key using the REST API, see Adding API restrictions in the API Key API documentation.

  Get project information from a key string

  You can determine which Google Cloud project an API key is associated with from its string.

  Replace

  curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d {'"displayName" : "DISPLAY_NAME"'} \ "https://apikeys.googleapis.com/v2/projects/PROJECT/locations/global/keys" 02 with the key string you need project information for.

  gcloud

  You use the gcloud alpha services api-keys lookup command to get the project ID from a key string.

  curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d {'"displayName" : "DISPLAY_NAME"'} \ "https://apikeys.googleapis.com/v2/projects/PROJECT/locations/global/keys" 9

  REST

  You use the lookupKey method to get the project ID from a key string.

  POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY0

  Poll long-running operations

  API Key API methods use long-running operations. If you use the REST API to create and manage API keys, an operation object is returned from the initial method request. You use the operation name to poll the long-running operation. When the long-running request completes, polling the operation returns the data from the long-running request.

  To poll a long-running API Key API operation, you use the

  curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d {'"displayName" : "DISPLAY_NAME"'} \ "https://apikeys.googleapis.com/v2/projects/PROJECT/locations/global/keys" 03 method.

  Replace

  curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d {'"displayName" : "DISPLAY_NAME"'} \ "https://apikeys.googleapis.com/v2/projects/PROJECT/locations/global/keys" 04 with the operation name returned by the long-running operation. For example,

  curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d {'"displayName" : "DISPLAY_NAME"'} \ "https://apikeys.googleapis.com/v2/projects/PROJECT/locations/global/keys" 05.

  POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY1

  Limits on API keys

  You can create up to 300 API keys per project. This limit is a system limit, and cannot be changed using a quota increase request.