If you have ever wondered, where is my Google API key, you are not alone. This guide walks through exactly how to locate the key for your project and what steps to take next.
Use the structured overview below to understand where Google API keys live, how they differ from OAuth credentials, and how to control access to them.
| Key Type | Typical Use Case | Where It Lives | Visibility & Restrictions |
|---|---|---|---|
| API Key | Public clients, server-to-server calls, maps, static data | Google Cloud console under APIs & Services & Credentials | Visible to owners and users with view permissions; restrict by HTTP referrer or IP |
| OAuth 2.0 Client ID | User sign in, installed apps, web apps | Same credentials page, labeled as OAuth 2.0 Client IDs | Not a raw key; contains client secret; requires consent screen configuration |
| Service Account Key | Server-to-server automation, CI/CD, backend services | IAM & Admin & Service Accounts, then generate key | JSON key file with private key; store securely and rotate regularly |
| Restricted Key | Limit exposure by API, IP, or referrer | Credentials page, set restrictions at creation or edit | Reduces risk if leaked; enforce before going live |
Finding the key in the Google Cloud console
To answer where is my Google API key for the first time, start with the official Google Cloud console. From the navigation menu, open APIs & Services, then click Credentials to see every key and client ID associated with your account.
The credentials page shows distinct rows for API keys, OAuth 2.0 clients, and service account keys. Sort and filter by name or creation date so you can quickly match a key to the app or service you are troubleshooting.
Click the name or pencil icon to reveal details, copy the key string, and review its current restrictions. This view is the central answer to where is my Google API key when you need to locate or rotate it.
Securing and restricting your API key
Once you find the key, set HTTP referrer, IP address, or API restrictions to prevent unauthorized use. Careful restrictions are essential whether you are searching where is my Google API key for a new project or hardening an existing one.
Rotate keys on a regular schedule, store them outside of source control, and enable Cloud Logging to detect anomalous usage patterns. Treat every exposed key as a potential security incident until proven otherwise.
Consider moving long lived server keys to service accounts with fine grained IAM roles, which make it easier to apply the principle of least privilege and reduce key management overhead.
Troubleshooting common location issues
If your calls fail with a request missing a valid API key, revisit the credentials page to confirm that the key is attached to the correct project and that no conflicting credentials are set in client libraries or environment variables.
For quota or authentication errors, verify that the APIs you intend to use are enabled in the same project where the key was created, because a key is only valid within projects that have those APIs activated.
When keys are managed through shared folders or organization policies, check for overrides at the folder or organization level, as these can block expected behavior even when the console seems correctly configured.
Best practices for managing Google API keys going forward
- Always restrict API keys by HTTP referrer or IP address to the minimum required set of domains and addresses.
- Enable Cloud Monitoring and log alerts for spikes in quota usage or unexpected error rates.
- Use service accounts instead of long lived API keys for backend automation and CI/CD pipelines.
- Store keys in a secrets manager, never in client side code or public repositories.
- Schedule regular reviews of credentials to remove unused keys and tighten permissions.
FAQ
Reader questions
Why does my API key not work even though it is copied correctly?
Check that the APIs you are calling are enabled in the same Google Cloud project as the key, and confirm that the key has the required referrer or IP restrictions configured for your client.
Where can I see usage and quota for my API key?
Open the Google Cloud console, navigate to APIs & Services, then Dashboard, and select the key or project to review quota metrics, recent requests, and cost trends.
Can I restrict my API key after it has already been shared publicly?
Yes, edit the key in the credentials page to add referrer, IP, or API restrictions immediately. These limits take effect right away and help prevent abuse if the key was previously exposed.
How often should I rotate my Google API key or service account key?
Rotate keys at least every 90 days, rotate immediately if you suspect exposure, and automate rotation for service accounts using workload identity federation where possible.