How to Set Security Restrictions for a Gemini API Key: Preventing Sky-High Losses from Key Leaks
What should you do if you accidentally commit an API key to GitHub? This step-by-step guide shows you how to configure an IP allowlist, HTTP referrer domain binding, and service scope restrictions for your key in the Google Cloud console.
1. The Huge Danger of an Exposed API Key
Many beginners push code containing an API key directly to a public GitHub repository. Within ten minutes, the key will be scanned and captured by crawlers across the internet and maliciously consumed.
2. Three Steps to Harden Your API Key Defenses
1. Go to the Credentials page in the Google Cloud console and find the corresponding API key.
2. Under Application restrictions, select IP addresses and enter the public IP of your backend production server. Requests from any other IP will be rejected outright.
3. Under API restrictions, select Restrict key and allow only the Generative Language API, so the key cannot be used to call other high-cost cloud services.