Restricting Google Cloud Keys

A problem (and solution) encountered while trying to restrict Google Cloud API keys for a Flutter app.

Restricting GCloud Keys

Google Cloud allows you to restrict your app’s API keys to only certain APIs, and to only certain clients, such as your website, or IP addresses, or to your Android and iOS apps. We are using the Google Places API via the google_place Flutter package. However, every time we tried to restrict the Places API key to only our apps the API would stop working. What’s going on?

The cause was the google_place package uses the web API internally, not the native Android and iOS APIs. This means that requests did not have any indicator that they were coming from our app, and were being denied.

The solution? Find a package that uses the native SDKs, or write it if one can’t be found. Fortunately the flutter_google_places_sdk package uses the native SDKs, and therefore correctly indicates requests are coming from our app.