All geek questions in one place

This IP, site or mobile application is not authorized to use this API key.

I am trying to restrict the use of my Android API key (for the Google Maps Direction API) for Android applications signed with my SHA-1 fingerprints. The key will work just fine if I don’t add the package name and fingerprint under the credentials of the Google Developers Console. But when I add them, this error occurs:

W / System.err: com.google.maps.errors.RequestDeniedException: This IP, site, or mobile application is not allowed to use this API key. Request received from IP address XX.XX.XXX.XXX, with a blank reference number

Most of the answers that were given to solve this error relate to the Places APIs and solve it by switching to the Server API key. I need to use an Android key and you want to restrict users to this key.

Points that I noticed: 1) Google recognizes that I am using a valid API key. 2) Google will recognize the correct SHA-1 signature, Google will show a signature error if I use the wrong API key.

Any help would be greatly appreciated!

+5
source share
1 answer

As you already found, any API key will work here until it is protected, but the Android API protected key will not work for the Google Maps Directions APIs.

Simply put, you need to use the server API key for the Directions APIs (or any of the webservice APIs).

From the documentation ::

The Google Maps Directions API will only work with the server key.

The reason for this is that these webservice APIs were originally intended to be used on websites, not Android apps.

In addition, the only way to protect the server key is the IP address, so there is no way to do this on the client side.

The official recommendation of Google is to use a proxy server to which the application executes requests and makes an API Directions request from a proxy server.

See here (This applies to the Places web services API, but it is valid for any of the webservice APIs): https://groups.google.com/forum/#!topic/google-places-api/SmujrL-pDpU p>

Google employee answer:

Alexei

Any saved client side is compromising, even with confusion, you make it a little slower for dedicated hacker access.

I would advise you to configure the application to send its places requests without an API key to the proxy server to receive the request, add the API key at the end of the request, send the request and then receive and return a response from the request to your application.

Greetings

Chris

+11
source

Source: https://habr.com/ru/post/1239442/

More articles:


All Articles