Skip to content

Google Maps Platform — APIs, Keys & Usage

Last reviewed: 2026-09-17

Purpose: Reference for the Google Maps Platform — the individual APIs, secure API-key provisioning and restriction, and minimal usage examples for the browser and REST endpoints.

Overview

Google Maps Platform is a family of location APIs billed per request against a Google Cloud project. Keys are project-scoped credentials: each key can be restricted to specific APIs and to specific callers (HTTP referrers, IP addresses, or mobile app identities), which is the primary defence against key theft and runaway billing.

A typical request flow:

Client (browser or server)
    │  HTTPS request signed with an API key
    ▼
Google Maps Platform endpoint  ──►  Geocoding / Directions / Places / JS API
    │
    └──► usage recorded against the Cloud project → billing + quotas

Topics Covered

  • Maps JavaScript API — embed interactive maps in web pages
  • Geocoding API — convert addresses to coordinates and back
  • Directions API — routes and travel times
  • Places API — businesses, addresses and points of interest
  • Distance Matrix API — travel time/distance for many origins and destinations
  • Elevation API — ground elevation for coordinates
  • Roads API — snap GPS traces to the road network
  • API key provisioning, restriction and rotation

API Key Setup

  1. Go to the Google Cloud Console
  2. Create a new project (or select an existing one)
  3. Navigate to APIs & Services → Credentials
  4. Click Create Credentials → API Key
  5. Restrict the key (application restriction + API restriction — see the table below)
  6. Enable only the APIs the key needs:
  7. Maps JavaScript API
  8. Geocoding API
  9. Directions API
  10. Places API
  11. Distance Matrix API
  12. Reference the key from an environment variable or secret manager rather than source code

Restricting Keys

Restriction Applies to Notes
HTTP referrers Browser-side keys Lock to your domains, e.g. https://example.com/*
IP addresses Server-side calls Lock to egress IPs or CIDR ranges
Android / iOS apps Mobile SDKs Lock to package name + signing certificate
API restrictions All keys Enable only the APIs that key must call
Quotas Per API, per project Set per-key daily quotas to cap spend

Security note: never commit a key to a repository, never ship a server-side key to a browser, and prefer separate keys per environment (dev / staging / prod) so one can be revoked alone.

Usage Examples

Web — Maps JavaScript API

<script>
  function initMap() {
    const map = new google.maps.Map(document.getElementById("map"), {
      center: { lat: 48.8566, lng: 2.3522 },
      zoom: 12,
    });
  }
</script>
<script
  src="https://maps.googleapis.com/maps/api/js?key=YOUR_API_KEY&callback=initMap"
  async defer>
</script>

Load the key through a server-side template or build-time placeholder, not as a literal committed to the repository.

Geocoding — REST

curl "https://maps.googleapis.com/maps/api/geocode/json?address=1600+Amphitheatre+Parkway,+Mountain+View,+CA&key=YOUR_API_KEY"

Directions — REST

curl "https://maps.googleapis.com/maps/api/directions/json?origin=Paris&destination=Lyon&mode=driving&key=YOUR_API_KEY"

curl "https://maps.googleapis.com/maps/api/place/nearbysearch/json?location=48.8566,2.3522&radius=1000&type=restaurant&key=YOUR_API_KEY"

Distance Matrix — REST

curl "https://maps.googleapis.com/maps/api/distancematrix/json?origins=Paris&destinations=Lyon|Marseille&key=YOUR_API_KEY"

All REST endpoints return JSON with a status field (OK, ZERO_RESULTS, OVER_QUERY_LIMIT, REQUEST_DENIED, …) — check it before parsing the payload.

Cost & Quota Controls

Control Where Why
Budget alerts Cloud Billing Warn before spend spikes
Per-API quotas APIs & Services → Quotas Hard ceiling per endpoint
Key-level quotas Credentials → key Contain the blast radius of one leaked key
Usage metrics Cloud Monitoring Attribute traffic to specific callers
Caching Application side Geocoding and elevation results rarely change — cache them

Google Cloud grants a recurring monthly credit, but it is a billing credit, not a free tier: overage is charged normally.

Security Best Practices

  1. Restrict API keys — never leave a key unrestricted
  2. Use environment variables — never hardcode API keys in source code
  3. Enable billing alerts — set up budget alerts in Google Cloud Console
  4. Monitor usage — track API calls in the Cloud Console dashboard
  5. Rotate keys — periodically regenerate keys and retire the old ones
  6. Separate keys per environment — dev, staging and production keys independently revocable

Resources