Google has tools to restrict usage of your API key to certain HTTP referrers and apps. https://cloud.google.com/docs/authentication/api-keys?hl=en&visit_id=638

Google has tools to restrict usage of your API key to certain HTTP referrers and apps. https://cloud.google.com/docs/authentication/api-keys?hl=en&visit_id=638343634249811087-3665802784&rd=1#api_key_restrictions https://cloud.google.com/docs/authentication/api-keys?hl=en&... It's not perfect; there are ways to subvert it. But it makes it trickier for somebody to make much of a profit off it, reducing interest in stealing the key.