🕷️ Crawler Inspector

URL Lookup

Direct Parameter Lookup

Raw Queries and Responses

1. Shard Calculation

Query:

Response:

Calculated Shard: 95 (from laksa152)

2. Crawled Status Check

Query:

curl -X POST \
  'http://laksa095.int.ahrefs:8124/' \
  -H 'Content-Type: text/plain' \
  -H 'X-ClickHouse-Database: crawler3' \
  -H 'Authorization: Basic YXBpOg==' \
  -d 'SELECT getAhrefsURLFromUnparsed(src_unparsed) AS found_url, ifNull(toUnixTimestamp(download_stamp), 0) AS crawl_time, ifNull(toUnixTimestamp(props_url_first_seen), 0) AS first_indexed_time, download_http_code AS http_code, src_unparsed AS src_unparsed, src_root_hash AS src_root_hash, history_drop_reason AS history_drop_reason, meta_title AS meta_title, meta_descriptions AS meta_descriptions, attrs_boilerpipe_text AS attrs_boilerpipe_text, attrs_markdown AS attrs_markdown, attrs_readable_markdown AS attrs_readable_markdown, meta_canonical AS meta_canonical FROM crawler3.page_info_local FINAL PREWHERE (src_root_hash, src_unparsed) IN ((getAhrefsRootHashFromUnparsed(getAhrefsUnparsedNoserviceFromURL(\'https://docs.cloud.google.com/docs/authentication/api-keys\')), getAhrefsUnparsedNoserviceFromURL(\'https://docs.cloud.google.com/docs/authentication/api-keys\'))) FORMAT JSONEachRow'

Response:

{"found_url":"https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys","crawl_time":1761157137,"first_indexed_time":0,"http_code":200,"src_unparsed":"com,google!cloud,docs,\/docs\/authentication\/api-keys s443","src_root_hash":"744624608793826895","history_drop_reason":null,"meta_title":"Manage API keys | Authentication | Google Cloud Documentation","meta_descriptions":[],"attrs_boilerpipe_text":"This page describes how to create, edit, and restrict API keys. For information\nabout how to use API keys to access Google APIs, see\n Use API keys to access APIs . Introduction to API keys There are two types of API keys: standard API keys, and API keys that have been\nbound to a service account. Standard API keys Standard API keys provide a way to associate a request with a project for\nbilling and quota purposes. When you use a standard API key (an API key that has\nnot been bound to a service account) to access an API, the API key doesn't\nidentify a  principal . Without a principal, the\nrequest can't use Identity and Access Management (IAM) to check whether the caller is\nauthorized to perform the requested operation. Standard API keys can be used with any API that accepts API keys, unless API\nrestrictions have been added to the key. Standard API keys can't be used with\nservices that don't accept API keys, including in\n express mode . API keys bound to a service account API keys bound to a service account provide the identity and authorization of\nthe service account to a request. When you use an API key that has been bound to\na service account to access an API, your request is processed as if you used the\nbound service account to make the request. The only API that supports bound API keys is  aiplatform.googleapis.com . Binding keys to a service account is prevented by a default organization policy\nconstraint. To change this, see\n Enable key binding to service accounts . API key components An API key has the following components, which let you manage and use the\nkey: String The API key string is an encrypted string, for example,\n AIzaSyDaGmWKa4JsXZ-HjGw7ISLn_3namBGewQe . When you use an API key to\naccess an API, you always use the key's string. API keys don't have an\nassociated JSON file. ID The API key ID is used by Google Cloud administrative tools to uniquely\nidentify the key. The key ID can't be used to access APIs. The key ID can be\nfound in the URL of the key's edit page in the Google Cloud console. You can also\nget the key ID by using the Google Cloud CLI to list the keys in your project. Display name The display name is an optional, descriptive name for the key,\nwhich you can set when you create or update the key. Bound service account API keys that are bound to a service account include the service account's\nemail address. Before you begin Complete the following tasks to use the samples on this page. Set up authentication Select the tab for how you plan to use the samples on this page: Console \n        When you use the Google Cloud console to access Google Cloud services and\n        APIs, you don't need to set up authentication.\n       gcloud In the Google Cloud console, activate Cloud Shell. Activate Cloud Shell \n      At the bottom of the Google Cloud console, a\n       Cloud Shell \n      session starts and displays a command-line prompt. Cloud Shell is a shell environment\n      with the Google Cloud CLI\n      already installed and with values already set for\n      your current project. It can take a few seconds for the session to initialize.\n     C++ \n      To use the C++ samples on this page in a local\n      development environment, install and initialize the gcloud CLI, and\n      then set up Application Default Credentials with your user credentials.\n   Install  the Google Cloud CLI.\n       If you're using an external identity provider (IdP), you must first\n             \n              sign in to the gcloud CLI with your federated identity .\n           \n  \n        If you're using a local shell, then create local authentication credentials for your user\n        account:\n  \n       gcloud auth application-default login You don't need to do this if you're using Cloud Shell. \n        If an authentication error is returned, and you are using an external identity provider\n        (IdP), confirm that you have\n         \n          signed in to the gcloud CLI with your federated identity .\n       \n   \n    For more information, see\n     \n      Set up ADC for a local development environment \n    in the Google Cloud authentication documentation.\n  \n Java \n      To use the Java samples on this page in a local\n      development environment, install and initialize the gcloud CLI, and\n      then set up Application Default Credentials with your user credentials.\n   Install  the Google Cloud CLI.\n       If you're using an external identity provider (IdP), you must first\n             \n              sign in to the gcloud CLI with your federated identity .\n           \n  \n        If you're using a local shell, then create local authentication credentials for your user\n        account:\n  \n       gcloud auth application-default login You don't need to do this if you're using Cloud Shell. \n        If an authentication error is returned, and you are using an external identity provider\n        (IdP), confirm that you have\n         \n          signed in to the gcloud CLI with your federated identity .\n       \n   \n    For more information, see\n     \n      Set up ADC for a local development environment \n    in the Google Cloud authentication documentation.\n  \n Python \n      To use the Python samples on this page in a local\n      development environment, install and initialize the gcloud CLI, and\n      then set up Application Default Credentials with your user credentials.\n   Install  the Google Cloud CLI.\n       If you're using an external identity provider (IdP), you must first\n             \n              sign in to the gcloud CLI with your federated identity .\n           \n  \n        If you're using a local shell, then create local authentication credentials for your user\n        account:\n  \n       gcloud auth application-default login You don't need to do this if you're using Cloud Shell. \n        If an authentication error is returned, and you are using an external identity provider\n        (IdP), confirm that you have\n         \n          signed in to the gcloud CLI with your federated identity .\n       \n   \n    For more information, see\n     \n      Set up ADC for a local development environment \n    in the Google Cloud authentication documentation.\n  \n REST \n    To use the REST API samples on this page in a local development environment, you use the\n    credentials you provide to the gcloud CLI.\n   Install  the Google Cloud CLI.\n        \n       \n        If you're using an external identity provider (IdP), you must first\n         \n          sign in to the gcloud CLI with your federated identity .\n       \n  For more information, see\n   Authenticate for using REST \n  in the Google Cloud authentication documentation.\n Required roles \n    \n      To get the permissions that\n      you need to manage API keys,\n    \n      ask your administrator to grant you the\n    following IAM roles on your project:\n  \n     API Keys Admin   ( roles\/serviceusage.apiKeysAdmin )\n     \n            Restrict an API key to specific APIs by using the Google Cloud console:\n              \n  \n  \n    \n       Service Usage Viewer   ( roles\/serviceusage.serviceUsageViewer )\n    \n            \n           \n  \n  \n  For more information about granting roles, see  Manage access to projects, folders, and organizations .\n  \n   \n        You might also be able to get\n        the required permissions through  custom\n        roles  or other  predefined\n        roles .\n       Enable key binding to service accounts Before you can  bind an API key to a service account , you\nfirst need to set the\n constraints\/iam.managed.disableServiceAccountApiKeyCreation  organization\npolicy constraint to  false . Changing the organization policy requires an\nassociated\n organization resource .\nProjects without an organization aren't supported. To change the policy constraint, complete the following instructions.  Console  In the Google Cloud console, go to the  Organization policies  page. Go to Organization policies Switch to the organization, folder, or project you want to change the\npolicies for. In the  Filter  box, enter  Block service , and then click the filter\nname  Block service account API key bindings . Click  Manage policy . In the  Policy source  section, select  Override parent's policy . Click  Add a rule , and set  Enforcement  to  Off . Click  Done . Optional: Click  Test changes  to give you insight on how the proposed\npolicy might cause compliance violations or disruptions. Click  Set policy .  gcloud  Create a file named  spec.yaml , with the following content: name : SCOPE \/ SCOPE_ID \/policies\/iam.managed.disableServiceAccountApiKeyCreation\n spec : rules : - enforce : false Provide the following values: SCOPE : Either  organizations ,  folders , or\n projects . SCOPE_ID : Depending on  SCOPE , the ID of\nthe organization, folder, or project to which the organization policy\napplies. Run the following  gcloud  command to allow binding of API keys to service\naccounts: gcloud org-policies set-policy spec.yaml \\ --update-mask spec\n Create an API key To create an API key, use one of the following options:  Console  In the Google Cloud console, go to the  Credentials  page: Go to Credentials Click  Create credentials , and then select  API key  from the menu. Optional: To bind the API key to a service account, select the\n Authenticate API calls through a service account  checkbox and then\nclick  Select a service account  to select the service account you want\nto bind to the key. For more information, see\n API keys bound to a service account . Add API key restrictions. Restricting API keys is a best practice. For more information, see\n Apply API key restrictions . Click  Create . The  API key created  dialog displays the string for\nyour newly created key.  gcloud  You use the\n  gcloud services api-keys create  command \n to create an API key. Replace  DISPLAY_NAME  with a descriptive name for\n your key. gcloud services api-keys create \\ --display-name = DISPLAY_NAME Optional: To bind the API key to a service account, use  gcloud beta \n instead, with the  --service-account  flag: gcloud beta services api-keys create \\ --display-name = DISPLAY_NAME \\ --service-account = SERVICE_ACCOUNT_EMAIL_ADDRESS For more information, see\n  API keys bound to a service account .  C++  To run this sample, you must install the\n API Keys client library .  Java  To run this sample, you must install the\n google-cloud-apikeys  client library .  Python  To run this sample, you must install the\n API Keys client library .  REST  You use the\n keys.create  method \nto create an API key. This request returns a\n long-running operation ; you must poll\nthe operation to get the information for the new key. Replace the following values: DISPLAY_NAME : Optional. A descriptive name for your\nkey. PROJECT_ID : Your Google Cloud project ID or name. curl - X POST \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ - H \"Content-Type: application\/json; charset=utf-8\" \\ - d { ' \"displayName\" : \" DISPLAY_NAME \" ' } \\ \"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT \/locations\/global\/keys\" Optional: To bind the API key to a service account instead, use the following\ncommand: curl - X POST \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ - H \"Content-Type: application\/json; charset=utf-8\" \\ - d { ' \"displayName\" : \" DISPLAY_NAME \" , \"serviceAccountEmail\" : \" SERVICE_ACCOUNT_EMAIL \" ' } \\ \"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT \/locations\/global\/keys\" For more information, see\n API keys bound to a service account . For more information about creating API keys using the REST API, see\n Creating an API key  in the\nAPI Keys API documentation. Apply API key restrictions API keys are unrestricted by default. Unrestricted keys are insecure because\nthey can be used by anyone from anywhere. For production applications, you\nshould set both  application restrictions  and\n API restrictions . Add application restrictions Application restrictions specify which websites, IP addresses, or apps can use\nan API key. You can apply only one application restriction type at a time.\nChoose the restriction type based on your application type: Option Application type Notes HTTP referrers Web applications Specifies the websites that can use the key. IP Addresses Applications called by specific servers Specifies the servers or cron jobs that can use the key. This is the only restriction available if you bind your API key to a service account. Android apps Android applications Specifies the Android application that can use the key. iOS apps iOS applications Specifies the iOS bundles that can use the key. HTTP referrers To restrict the websites that can use your API key, you add one or more\nHTTP referrer restrictions. You can substitute a wildcard character ( * ) for the subdomain or the path, but\nyou can't insert a wildcard character into the middle of the URL. For example,\n *.example.com  is valid, and accepts all sites ending in  .example.com . However,\n mysubdomain*.example.com  is not a valid restriction. Port numbers can be included in HTTP referrer restrictions. If you include a\nport number, then only requests using that port are matched. If you don't\nspecify a port number, then requests from any port number are matched. The following table shows some example scenarios and browser restrictions: Scenario Restrictions Allow a specific URL Add a URL with an exact path. For example: www.example.com\/path www.example.com\/path\/path \n  Some browsers implement a\n   \n  referrer policy  that sends only the origin URL for cross-origin requests.\n  Users of these browsers can't use keys with page-specific URL restrictions.\n Allow any URL in your site You must set two URLs in the  allowedReferers  list. \n  URL for the domain, without a subdomain, and with a wildcard for\n  the path. For example: example.com\/* \n  A second URL that includes a wildcard for the subdomain and a\n  wildcard for the path. For example: *.example.com\/* Allow any URL in a single subdomain or naked domain \n    You must set two URLs in the  allowedReferers  list to allow an\n    entire domain:\n   \n  URL for the domain, without a trailing slash. For example: www.example.com sub.example.com example.com \n  A second URL for the domain that includes a wildcard for the path.\n  For example: www.example.com\/* sub.example.com\/* example.com\/* To restrict your API key to specific websites, use one of the following options:  Console  In the Google Cloud console, go to the  Credentials  page: Go to Credentials Click the name of the API key that you want to restrict. In the  Application restrictions  section, select  HTTP referrers . For each restriction that you want to add, click  Add an item , enter\nthe restriction, and click  Done . Click  Save  to save your changes and return to the API key list.  gcloud  Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get\nthe ID by using the\n gcloud services api-keys list  command \nto list the keys in your project. Use the\n gcloud services api-keys update  command \nto add HTTP referrer restrictions to an API key. Replace the following values: KEY_ID : The ID of the key that you want to\nrestrict. ALLOWED_REFERRER_1 : Your HTTP referrer\nrestriction. You can add as many restrictions as needed; use commas to separate\nthe restrictions. You must provide all referrer restrictions with the\nupdate command; the referrer restrictions provided replace any existing\nreferrer restrictions on the key. gcloud services api-keys update KEY_ID \\ --allowed-referrers = \" ALLOWED_REFERRER_1 \"  Java  To run this sample, you must install the\n google-cloud-apikeys  client library .  Python  To run this sample, you must install the\n API Keys client library .  REST  Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get\nthe ID by using the\n keys.list \nmethod. The ID is listed in the  uid  field of the response. Replace  PROJECT_ID  with your Google Cloud project\nID or name. curl - X GET \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ \"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/\" Use the\n keys.patch \nmethod to add HTTP referrer restrictions to the API key. This request\nreturns a  long-running operation ; you must poll the operation to\nknow when the operation completes and get the operation status. Replace the following values: ALLOWED_REFERRER_1 : Your HTTP referrer\nrestriction. You can add as many restrictions as needed; use commas to separate\nthe restrictions. You must provide all referrer restrictions with the\nrequest; the referrer restrictions provided replace any existing\nreferrer restrictions on the key. PROJECT_ID : Your Google Cloud project ID or\nname. KEY_ID : The ID of the key that you want to\nrestrict. curl - X PATCH \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ - H \"Content-Type: application\/json; charset=utf-8\" \\ -- da ta ' { \"restrictions\" : { \"browserKeyRestrictions\" : { \"allowedReferrers\" : [ \" ALLOWED_REFERRER_1 \" ] } } } ' \\ \"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/ KEY_ID ?updateMask=restrictions\" For more information about adding HTTP referrer restrictions to a key using\nthe REST API, see\n Adding browser restrictions \nin the API Keys API documentation. IP Addresses You can specify one or more IP addresses of the callers, such as a web\nserver or cron job, that are allowed to use your API key. You can specify the\nIP addresses in any of the following formats: IPv4 ( 198.51.100.1 ) IPv6 ( 2001:db8::1 ) A subnet using CIDR notation ( 198.51.100.0\/24 ,  2001:db8::\/64 ) Using  localhost  is not supported for server restrictions. To restrict your API key to specific IP addresses, use one of the following\noptions:  Console  In the Google Cloud console, go to the  Credentials  page: Go to Credentials Click the name of the API key that you want to restrict. In the  Application restrictions  section, select  IP addresses . For each IP address that you want to add, click  Add an item , enter\nthe address, and click  Done . Click  Save  to save your changes and return to the API key list.  gcloud  Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get\nthe ID by using the\n gcloud services api-keys list  command \nto list the keys in your project. Use the\n gcloud services api-keys update  command \nto add server (IP address) restrictions to an API key. Replace the following values: KEY_ID : The ID of the key that you want to\nrestrict. ALLOWED_IP_ADDR_1 : Your allowed IP address. You can add as many IP addresses as needed; use commas to separate\nthe addresses. gcloud services api-keys update KEY_ID \\ \n--allowed-ips = \" ALLOWED_IP_ADDR_1 \"  Java  To run this sample, you must install the\n google-cloud-apikeys  client library .  Python  To run this sample, you must install the\n API Keys client library .  REST  Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get\nthe ID by using the\n keys.list \nmethod. The ID is listed in the  uid  field of the response. Replace  PROJECT_ID  with your Google Cloud project ID\nor name. curl - X GET \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ \"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/\" Use the\n keys.patch \nmethod to add server (IP address) restrictions to an API key. This request\nreturns a  long-running operation ; you must poll the operation to\nknow when the operation completes and get the operation status. Replace the following values: ALLOWED_IP_ADDR_1 : Your allowed IP address. You can add as many IP addresses as needed; use commas to separate\nthe restrictions. You must provide all IP addresses with the\nrequest; the referrer restrictions provided replace any existing\nIP address restrictions on the key. PROJECT_ID : Your Google Cloud project ID or\nname. KEY_ID : The ID of the key that you want to\nrestrict. curl - X PATCH \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ - H \"Content-Type: application\/json; charset=utf-8\" \\ -- da ta ' { \"restrictions\" : { \"serverKeyRestrictions\" : { \"allowedIps\" : [ \" ALLOWED_IP_ADDR_1 \" ] } } } ' \\ \"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/ KEY_ID ?updateMask=restrictions\" For more information about adding IP address restrictions to a key using the\nREST API, see\n Adding server restrictions \nin the API Keys API documentation. Android apps You can restrict usage of an API key to specific Android apps. You must provide\nthe package name and the 20-byte SHA-1 certificate fingerprint for each app. When you use the API key in a request, you must specify the package name\nand certificate fingerprint by using the following HTTP headers: X-Android-Package X-Android-Cert To restrict your API key to one or more Android apps, use one of the following\noptions:  Console  In the Google Cloud console, go to the  Credentials  page: Go to Credentials Click the name of the API key that you want to restrict. In the  Application restrictions  section, select  Android apps . For each Android app that you want to add, click  Add an item  and enter\nthe package name and SHA-1 certificate fingerprint, then click  Done . Click  Save  to save your changes and return to the API key list.  gcloud  Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get\nthe ID by using the\n gcloud services api-keys list  command \nto list the keys in your project. Use the\n gcloud services api-keys update  command \nto specify the Android apps that can use an API key. Replace the following values: KEY_ID : The ID of the key that you want to\nrestrict. SHA1_FINGERPRINT  and\n PACKAGE_NAME : The app\ninformation for an Android app that can use the key. You can add as many apps as needed; use additional\n --allowed-application  flags. gcloud services api-keys update KEY_ID \\ \n--allowed-application = sha1_fingerprint = SHA1_FINGERPRINT_1 ,package_name = PACKAGE_NAME_1 \\ \n--allowed-application = sha1_fingerprint = SHA1_FINGERPRINT_2 ,package_name = PACKAGE_NAME_2  Java  To run this sample, you must install the\n google-cloud-apikeys  client library .  Python  To run this sample, you must install the\n API Keys client library .  REST  Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get\nthe ID by using the\n keys.list \nmethod. The ID is listed in the  uid  field of the response. Replace  PROJECT_ID  with your Google Cloud project\nID or name. curl - X GET \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ \"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/\" Use the\n keys.patch \nmethod to specify the Android apps that can use an API key. This request\nreturns a  long-running operation ; you must poll the operation to\nknow when the operation completes and get the operation status. Replace the following values: SHA1_FINGERPRINT_1  and\n PACKAGE_NAME_1 : The app\ninformation for an Android app that can use the key. You can add the information for as many apps as needed; use commas to\nseparate the\n AndroidApplication \nobjects. You must provide all applications with the request; the\napplications provided replace any existing allowed applications on the\nkey. PROJECT_ID : Your Google Cloud project ID or\nname. KEY_ID : The ID of the key that you want to\nrestrict. curl - X PATCH \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ - H \"Content-Type: application\/json; charset=utf-8\" \\ -- da ta ' { \"restrictions\" : { \"androidKeyRestrictions\" : { \"allowedApplications\" : [ { \"sha1Fingerprint\" : \" SHA1_FINGERPRINT_1 \" , \"packageName\" : \" PACKAGE_NAME_1 \" }, ] } } } ' \\ \"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/ KEY_ID ?updateMask=restrictions\" For more information about adding Android app restrictions to a key using the\nREST API, see\n Adding Android restrictions \nin the API Keys API documentation. iOS apps You can restrict usage of an API key to specific iOS apps by providing the\nbundle ID of each app. When you use the API key in a request, you must specify the bundle ID by using\nthe  X-Ios-Bundle-Identifier  HTTP header. To restrict your API key to one or more iOS apps, use one of the following\noptions:  Console  In the Google Cloud console, go to the  Credentials  page: Go to Credentials Click the name of the API key that you want to restrict. In the  Application restrictions  section, select  iOS apps . For each iOS app that you want to add, click  Add an item  and enter\nthe bundle ID, then click  Done . Click  Save  to save your changes and return to the API key list.  gcloud  Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get\nthe ID by using the\n gcloud services api-keys list  command \nto list the keys in your project. Use the\n gcloud services api-keys update \nmethod to specify the iOS apps that can use the key. Replace the following values: KEY_ID : The ID of the key that you want to\nrestrict. ALLOWED_BUNDLE_ID : The bundle ID of an iOS app\nthat you want to be able to use this API key. You can add as many bundle IDs as needed; use commas to separate the\nIDs. gcloud services api-keys update KEY_ID \\ \n--allowed-bundle-ids = ALLOWED_BUNDLE_ID_1 , ALLOWED_BUNDLE_ID_2  Java  To run this sample, you must install the\n google-cloud-apikeys  client library .  Python  To run this sample, you must install the\n API Keys client library .  REST  Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get\nthe ID by using the\n keys.list \nmethod. The ID is listed in the  uid  field of the response. Replace  PROJECT_ID  with your Google Cloud project\nID or name. curl - X GET \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ \"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/\" Use the\n keys.patch \nmethod to specify the iOS apps that can use an API key. This request\nreturns a  long-running operation ; you must poll the operation to\nknow when the operation completes and get the operation status. Replace the following values: ALLOWED_BUNDLE_ID : The bundle ID of an iOS app\nthat can use the key. You can add the information for as many apps as needed; use commas to\nseparate the bundle IDs. You must provide all bundle IDs with the\nrequest; the bundle IDs provided replace any existing allowed\napplications on the key. PROJECT_ID : Your Google Cloud project ID or\nname. KEY_ID : The ID of the key that you want to\nrestrict. curl - X PATCH \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ - H \"Content-Type: application\/json; charset=utf-8\" \\ -- da ta ' { \"restrictions\" : { \"iosKeyRestrictions\" : { \"allowedBundleIds\" : [ \" ALLOWED_BUNDLE_ID_1 \" , \" ALLOWED_BUNDLE_ID_2 \" ] } } } ' \\ \"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/ KEY_ID ?updateMask=restrictions\" For more information about adding iOS app restrictions to a key using the REST\nAPI, see\n Adding iOS restrictions \nin the API Keys API documentation. Add API restrictions API restrictions specify which APIs can be called using the API key. To add API restrictions, use one of the following options:  Console  In the Google Cloud console, go to the  Credentials  page: Go to Credentials Click the name of the API key that you want to restrict. In the  API restrictions  section, click  Restrict key . Select all APIs that your API key will be used to access. Click  Save  to save your changes and return to the API key list.  gcloud  Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get\nthe ID by using the\n gcloud services api-keys list  command \nto list the keys in your project. Use the\n gcloud services api-keys update  command \nto specify which services an API key can be used to access. Replace the following values: KEY_ID : The ID of the key that you want to\nrestrict. SERVICE_1 ,  SERVICE_2 ...:\nThe service names of the APIs that the key can be used to access. You must provide all service names with the update command; the service\nnames provided replace any existing services on the key. You can find the service name by searching for the API on the\n API dashboard . Service\nnames are strings like  bigquery.googleapis.com . gcloud services api-keys update KEY_ID \\ \n--api-target = service = SERVICE_1 --api-target = service = SERVICE_2  Java  To run this sample, you must install the\n google-cloud-apikeys  client library .  Python  To run this sample, you must install the\n API Keys client library .  REST  Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get\nthe ID by using the\n keys.list \nmethod. The ID is listed in the  uid  field of the response. Replace  PROJECT_ID  with your Google Cloud project\nID or name. curl - X GET \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ \"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/\" Use the\n keys.patch \nmethod to specify which services an API key can be used to access. This request returns a  long-running operation ; you must poll the\noperation to know when the operation completes and get the operation\nstatus. Replace the following values: SERVICE_1 ,  SERVICE_2 ...:\nThe service names of the APIs that the key can be used to access. You must provide all service names with the request; the service\nnames provided replace any existing services on the key. You can find the service name by searching for the API on the\n API dashboard . Service\nnames are strings like  bigquery.googleapis.com . PROJECT_ID : Your Google Cloud project ID or\nname. KEY_ID : The ID of the key that you want to\nrestrict. curl - X PATCH \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ - H \"Content-Type: application\/json; charset=utf-8\" \\ -- da ta ' { \"restrictions\" : { \"apiTargets\" : [ { \"service\" : \" SERVICE_1 \" }, { \"service\" : \" SERVICE_2 \" }, ] } } ' \\ \"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/ KEY_ID ?updateMask=restrictions\" For more information about adding API restrictions to a key using the REST\nAPI, see\n Adding API restrictions \nin the API Keys API documentation. Get project information from a key string You can determine which Google Cloud project an API key is associated with\nfrom its string. Replace  KEY_STRING  with the key string you need project\ninformation for.  gcloud  You use the\n  gcloud services api-keys lookup  command \n to get the project ID from a key string. gcloud services api-keys lookup KEY_STRING  Java  To run this sample, you must install the\n google-cloud-apikeys  client library .  Python  To run this sample, you must install the\n API Keys client library .  REST  You use the\n lookupKey  method \nto get the project ID from a key string. curl - X GET \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ - H \"Content-Type: application\/json; charset=utf-8\" \\ \"https:\/\/apikeys.googleapis.com\/v2\/keys:lookupKey?keyString= KEY_STRING \" Create a copy of an API key If you need a new API key with the same restrictions as an existing API key, you\ncan create a copy of the existing API key. This operation creates a new API key\nwith a unique key string and ID, with the existing API key's restrictions. The copy operation is available only in the Google Cloud console. To use other\nmethods, follow the steps to  create an API key , and then\n apply the same API key restrictions  to the newly\ngenerated API key. In the Google Cloud console, go to the  Credentials  page: Go to Credentials Click the name of the API key that you want to copy. The API key's details page opens. Click  Create a copy . Enter a name for the new API key and confirm that the restrictions are correct. Click  Create . Rotate an API key By periodically rotating your API keys, you can limit the impact of any\ncompromised API keys. When you rotate an API key, you create a new key with the same restrictions as\nthe old key, and update your applications to use the new key. After all of your\napplications are updated, you delete the old key. The rotation operation is available only in the Google Cloud console. To use other\nmethods, follow the steps to  create an API key , and then\n apply the same API key restrictions  to the newly\ngenerated API key. After updating your applications to use the new key, you\ndelete the old key. In the Google Cloud console, go to the  Credentials  page: Go to Credentials Click the name of the API key that you want to rotate to open its details page. Click  Rotate key . Enter a name for the new API key and confirm that the restrictions are correct. Click  Create . Copy the key string and update your applications to use the new string. After you have updated all applications to use the new key, return to the\ndetails page for the new key. In the  Previous key  section, click\n Delete the previous key  to delete the old key. If you find that you deleted the old key prematurely, you can\n undelete it . Undelete an API key If you delete an API key by mistake, you can undelete (restore) that key within\n30 days of deleting the key. After 30 days, you cannot undelete the API key.  Console  In the Google Cloud console, go to the  Credentials  page: Go to Credentials Click  Restore deleted credentials . Find the deleted API key that you want to undelete, and click  Restore . Undeleting an API key may take a few minutes to propagate. After\npropagation, the undeleted API key is displayed in the API keys list.  gcloud  Get the ID of the key that you want to undelete. The ID is not the same as the display name or the key string. You can get\nthe ID by using the\n gcloud services api-keys list --show-deleted  command \nto list the deleted keys in your project. Use the\n gcloud services api-keys undelete  command \nto undelete an API key. gcloud services api-keys undelete KEY_ID Replace the following values: KEY_ID : The ID of the key that you want to\nundelete.  Java  To run this sample, you must install the\n google-cloud-apikeys  client library .  REST  Get the ID of the key that you want to undelete. The ID is not the same as the display name or the key string. You can get\nthe ID by using the\n keys.list \nmethod, with the  showDeleted  query parameter set to  true .\nThe key ID is listed in the  uid  field of the response. Replace  PROJECT_ID  with your Google Cloud project\nID or name. curl - X GET \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ \"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys?showDeleted=true\" Use the\n undelete \nmethod to undelete the API key. curl - X POST \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ - H \"Content-Type: application\/json; charset=utf-8\" \\ \"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/ KEY_ID :undelete\" This request\nreturns a  long-running operation ; you must poll the operation to\nknow when the operation completes and get the operation status. Replace the following values: PROJECT_ID : Your Google Cloud project ID or\nname. KEY_ID : The ID of the key that you want to\nrestrict. Determine the API key type You can determine whether the API key is bound to a service account by\ninspecting the key.  Console  In the Google Cloud console, go to the  Credentials  page: Go to Credentials If the API key is bound to a service account, the service account\nidentifier is displayed.  gcloud  Get the ID of the key. The ID is not the same as the display name or the key string. You can get\nthe ID by using the\n gcloud services api-keys list  command \nto list the keys in your project. Use the\n gcloud services api-keys describe  command \nto describe the API key. gcloud services api-keys describe KEY_ID If the API key is bound to a service account, the  serviceAccountEmail \nfield is displayed. Poll long-running operations API Keys API methods use long-running operations. If you use the REST API to\ncreate and manage API keys, an operation object is returned from the initial\nmethod request. You use the operation name to poll the long-running operation.\nWhen the long-running request completes, polling the operation returns the\ndata from the long-running request. To poll a long-running API Keys API operation, you use the\n operations.get  method. Replace  OPERATION_NAME  with the operation name returned\nby the long-running operation. For example,\n operations\/akmf.p7-358517206116-cd10a88a-7740-4403-a8fd-979f3bd7fe1c . curl - X GET \\ - H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\ - H \"Content-Type: application\/json; charset=utf-8\" \\ \"https:\/\/apikeys.googleapis.com\/v2\/ OPERATION_NAME \" Limits on API keys You can create up to 300 API keys per project. This limit\nis a system limit, and can't be changed using a quota increase request.\nIf more API keys are needed, you must use more than one project. You can add up to 1200\n application restrictions  to an API key. What's next","attrs_markdown":"[Skip to main content](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#main-content)\n\n[![Google Cloud Documentation](https:\/\/www.gstatic.com\/devrel-devsite\/prod\/v59c691115ec6a53e3bf17af135bec44a3bb95c23eb778b8c9e469e221a6634ea\/clouddocs\/images\/lockup.svg)](https:\/\/docs.cloud.google.com\/)\n\n[Documentation](https:\/\/docs.cloud.google.com\/docs)\n\n[Technology areas](https:\/\/docs.cloud.google.com\/docs\/tech-area-overviews)\n\n- [AI and ML](https:\/\/docs.cloud.google.com\/docs\/ai-ml)\n- [Application development](https:\/\/docs.cloud.google.com\/docs\/application-development)\n- [Application hosting](https:\/\/docs.cloud.google.com\/docs\/application-hosting)\n- [Compute](https:\/\/docs.cloud.google.com\/docs\/compute-area)\n- [Data analytics and pipelines](https:\/\/docs.cloud.google.com\/docs\/data)\n- [Databases](https:\/\/docs.cloud.google.com\/docs\/databases)\n- [Distributed, hybrid, and multicloud](https:\/\/docs.cloud.google.com\/docs\/dhm-cloud)\n- [Generative AI](https:\/\/docs.cloud.google.com\/docs\/generative-ai)\n- [Industry solutions](https:\/\/docs.cloud.google.com\/docs\/industry)\n- [Networking](https:\/\/docs.cloud.google.com\/docs\/networking)\n- [Observability and monitoring](https:\/\/docs.cloud.google.com\/docs\/observability)\n- [Security](https:\/\/docs.cloud.google.com\/docs\/security)\n- [Storage](https:\/\/docs.cloud.google.com\/docs\/storage)\n\n[Cross-product tools](https:\/\/docs.cloud.google.com\/docs\/cross-product-overviews)\n\n- [Access and resources management](https:\/\/docs.cloud.google.com\/docs\/access-resources)\n- [Costs and usage management](https:\/\/docs.cloud.google.com\/docs\/costs-usage)\n- [Google Cloud SDK, languages, frameworks, and tools](https:\/\/docs.cloud.google.com\/docs\/devtools)\n- [Infrastructure as code](https:\/\/docs.cloud.google.com\/docs\/iac)\n- [Migration](https:\/\/docs.cloud.google.com\/docs\/migration)\n\n[Console](https:\/\/console.cloud.google.com\/)\n\n- [English]()\n- [Deutsch]()\n- [Español]()\n- [Español – América Latina]()\n- [Français]()\n- [Indonesia]()\n- [Italiano]()\n- [Português]()\n- [Português – Brasil]()\n- [中文 – 简体]()\n- [中文 – 繁體]()\n- [日本語]()\n- [한국어]()\n\nSign in\n\n[![](https:\/\/docs.cloud.google.com\/_static\/clouddocs\/images\/icons\/categories\/devops-color.svg)](https:\/\/docs.cloud.google.com\/docs\/authentication)\n\n- [Google Cloud SDK](https:\/\/docs.cloud.google.com\/sdk\/docs)\n- [Authentication](https:\/\/docs.cloud.google.com\/docs\/authentication)\n\n[Start free](https:\/\/console.cloud.google.com\/freetrial)\n\n[Guides](https:\/\/docs.cloud.google.com\/sdk\/docs\/install-sdk)\n\n[Reference](https:\/\/docs.cloud.google.com\/sdk\/docs\/libraries-reference)\n\n[Resources](https:\/\/docs.cloud.google.com\/sdk\/docs\/resources)\n\n[![Google Cloud Documentation](https:\/\/www.gstatic.com\/devrel-devsite\/prod\/v59c691115ec6a53e3bf17af135bec44a3bb95c23eb778b8c9e469e221a6634ea\/clouddocs\/images\/lockup.svg)](https:\/\/docs.cloud.google.com\/)\n\n- [Documentation](https:\/\/docs.cloud.google.com\/docs)\n  - [Guides](https:\/\/docs.cloud.google.com\/sdk\/docs\/install-sdk)\n  - [Reference](https:\/\/docs.cloud.google.com\/sdk\/docs\/libraries-reference)\n  - [Resources](https:\/\/docs.cloud.google.com\/sdk\/docs\/resources)\n- [Technology areas](https:\/\/docs.cloud.google.com\/docs\/tech-area-overviews)\n  - More\n- [Cross-product tools](https:\/\/docs.cloud.google.com\/docs\/cross-product-overviews)\n  - More\n- [Console](https:\/\/console.cloud.google.com\/)\n\n- Discover\n- [Google Cloud SDK overview](https:\/\/docs.cloud.google.com\/sdk)\n- [gcloud CLI overview](https:\/\/docs.cloud.google.com\/sdk\/gcloud)\n- [Cloud Client Libraries overview](https:\/\/docs.cloud.google.com\/apis\/docs\/cloud-client-libraries)\n- [Client libraries and Cloud APIs explained](https:\/\/docs.cloud.google.com\/apis\/docs\/client-libraries-explained)\n- Get started\n- [Install the Google Cloud CLI](https:\/\/docs.cloud.google.com\/sdk\/docs\/install-sdk)\n- Other CLI installation methods\n  \n  - [Recommended installation](https:\/\/docs.cloud.google.com\/sdk\/docs\/install)\n  - Other installation methods\n    \n    - Using Docker\n      \n      - [Overview](https:\/\/docs.cloud.google.com\/sdk\/docs\/downloads-docker)\n      - [Migrate to the :stable image](https:\/\/docs.cloud.google.com\/sdk\/docs\/migrate-docker-images)\n    - [Using a snap package](https:\/\/docs.cloud.google.com\/sdk\/docs\/downloads-snap)\n    - [Using versioned archives](https:\/\/docs.cloud.google.com\/sdk\/docs\/downloads-versioned-archives)\n    - [Using the installer](https:\/\/docs.cloud.google.com\/sdk\/docs\/downloads-interactive)\n- Authenticate to Google Cloud\n- [Authentication methods at Google](https:\/\/docs.cloud.google.com\/docs\/authentication)\n- Ways to authenticate\n  \n  - [Authenticate for using client libraries](https:\/\/docs.cloud.google.com\/docs\/authentication\/client-libraries)\n  - [Authenticate for using the gcloud CLI](https:\/\/docs.cloud.google.com\/docs\/authentication\/gcloud)\n  - [Authenticate for using REST](https:\/\/docs.cloud.google.com\/docs\/authentication\/rest)\n  - [Authenticate by using service account impersonation](https:\/\/docs.cloud.google.com\/docs\/authentication\/use-service-account-impersonation)\n- Application Default Credentials\n  \n  - Set up Application Default Credentials\n    \n    - [Overview](https:\/\/docs.cloud.google.com\/docs\/authentication\/provide-credentials-adc)\n    - [Local development environment](https:\/\/docs.cloud.google.com\/docs\/authentication\/set-up-adc-local-dev-environment)\n    - [Resource with an attached service account](https:\/\/docs.cloud.google.com\/docs\/authentication\/set-up-adc-attached-service-account)\n    - [Containerized environment](https:\/\/docs.cloud.google.com\/docs\/authentication\/set-up-adc-containerized-environment)\n    - [On-premises or another cloud provider](https:\/\/docs.cloud.google.com\/docs\/authentication\/set-up-adc-on-premises)\n    - [Cloud-based development environment](https:\/\/docs.cloud.google.com\/docs\/authentication\/set-up-adc-cloud-dev-environment)\n  - [How Application Default Credentials works](https:\/\/docs.cloud.google.com\/docs\/authentication\/application-default-credentials)\n  - [Troubleshoot your ADC setup](https:\/\/docs.cloud.google.com\/docs\/authentication\/troubleshoot-adc)\n- API keys\n  \n  - [Use API keys to access APIs](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys-use)\n  - [Manage API keys](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys)\n  - [Best practices for managing API keys](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys-best-practices)\n- [Get an ID token](https:\/\/docs.cloud.google.com\/docs\/authentication\/get-id-token)\n- Tokens\n  \n  - [Overview](https:\/\/docs.cloud.google.com\/docs\/authentication\/tokens)\n  - [Token types](https:\/\/docs.cloud.google.com\/docs\/authentication\/token-types)\n- [Multi-factor authentication requirement](https:\/\/docs.cloud.google.com\/docs\/authentication\/mfa-requirement)\n- [Reauthentication](https:\/\/docs.cloud.google.com\/docs\/authentication\/reauthentication)\n- [Authentication use cases](https:\/\/docs.cloud.google.com\/docs\/authentication\/use-cases)\n- [Identity management products](https:\/\/docs.cloud.google.com\/docs\/authentication\/identity-products)\n- Configure the gcloud CLI\n- [Initialize the gcloud CLI](https:\/\/docs.cloud.google.com\/sdk\/docs\/initializing)\n- [Authorize the gcloud CLI](https:\/\/docs.cloud.google.com\/sdk\/docs\/authorizing)\n- [Configure the gcloud CLI for use behind a proxy or firewall](https:\/\/docs.cloud.google.com\/sdk\/docs\/proxy-settings)\n- [Manage gcloud CLI configurations](https:\/\/docs.cloud.google.com\/sdk\/docs\/configurations)\n- [Manage gcloud CLI properties](https:\/\/docs.cloud.google.com\/sdk\/docs\/properties)\n- [Enable accessibility features](https:\/\/docs.cloud.google.com\/sdk\/docs\/enabling-accessibility-features)\n- Develop\n- [gcloud CLI cheat sheet](https:\/\/docs.cloud.google.com\/sdk\/docs\/cheatsheet)\n- [Scripting gcloud CLI commands](https:\/\/docs.cloud.google.com\/sdk\/docs\/scripting-gcloud)\n- [Client libraries best practices](https:\/\/docs.cloud.google.com\/apis\/docs\/client-libraries-best-practices)\n- Manage packages in gcloud CLI\n- [Managing gcloud CLI components](https:\/\/docs.cloud.google.com\/sdk\/docs\/components)\n- [Uninstalling the gcloud CLI](https:\/\/docs.cloud.google.com\/sdk\/docs\/uninstall-cloud-sdk)\n\n- [AI and ML](https:\/\/docs.cloud.google.com\/docs\/ai-ml)\n- [Application development](https:\/\/docs.cloud.google.com\/docs\/application-development)\n- [Application hosting](https:\/\/docs.cloud.google.com\/docs\/application-hosting)\n- [Compute](https:\/\/docs.cloud.google.com\/docs\/compute-area)\n- [Data analytics and pipelines](https:\/\/docs.cloud.google.com\/docs\/data)\n- [Databases](https:\/\/docs.cloud.google.com\/docs\/databases)\n- [Distributed, hybrid, and multicloud](https:\/\/docs.cloud.google.com\/docs\/dhm-cloud)\n- [Generative AI](https:\/\/docs.cloud.google.com\/docs\/generative-ai)\n- [Industry solutions](https:\/\/docs.cloud.google.com\/docs\/industry)\n- [Networking](https:\/\/docs.cloud.google.com\/docs\/networking)\n- [Observability and monitoring](https:\/\/docs.cloud.google.com\/docs\/observability)\n- [Security](https:\/\/docs.cloud.google.com\/docs\/security)\n- [Storage](https:\/\/docs.cloud.google.com\/docs\/storage)\n\n- [Access and resources management](https:\/\/docs.cloud.google.com\/docs\/access-resources)\n- [Costs and usage management](https:\/\/docs.cloud.google.com\/docs\/costs-usage)\n- [Google Cloud SDK, languages, frameworks, and tools](https:\/\/docs.cloud.google.com\/docs\/devtools)\n- [Infrastructure as code](https:\/\/docs.cloud.google.com\/docs\/iac)\n- [Migration](https:\/\/docs.cloud.google.com\/docs\/migration)\n\n- [Home](https:\/\/docs.cloud.google.com\/)\n- [Documentation](https:\/\/docs.cloud.google.com\/docs)\n- [Application development](https:\/\/docs.cloud.google.com\/docs\/application-development)\n- [Google Cloud SDK](https:\/\/docs.cloud.google.com\/sdk\/docs)\n- [Authentication](https:\/\/docs.cloud.google.com\/docs\/authentication)\n- [Guides](https:\/\/docs.cloud.google.com\/sdk\/docs\/install-sdk)\n\nSend feedback\n\n# Manage API keysStay organized with collections   Save and categorize content based on your preferences.\nThis page describes how to create, edit, and restrict API keys. For information about how to use API keys to access Google APIs, see [Use API keys to access APIs](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys-use).\n\n## Introduction to API keys\nThere are two types of API keys: standard API keys, and API keys that have been bound to a service account.\n\n### Standard API keys\nStandard API keys provide a way to associate a request with a project for billing and quota purposes. When you use a standard API key (an API key that has not been bound to a service account) to access an API, the API key doesn't identify a [principal](https:\/\/docs.cloud.google.com\/docs\/authentication#principal). Without a principal, the request can't use Identity and Access Management (IAM) to check whether the caller is authorized to perform the requested operation.\n\nStandard API keys can be used with any API that accepts API keys, unless API restrictions have been added to the key. Standard API keys can't be used with services that don't accept API keys, including in [express mode](https:\/\/cloud.google.com\/resources\/cloud-express-faqs).\n\n### API keys bound to a service account\nAPI keys bound to a service account provide the identity and authorization of the service account to a request. When you use an API key that has been bound to a service account to access an API, your request is processed as if you used the bound service account to make the request.\n\nThe only API that supports bound API keys is `aiplatform.googleapis.com`.\n\n**Caution:** API keys bound to service accounts are designed to accelerate the initial experience for developers exploring Google Cloud APIs. Don't use them in production environments. Instead, plan to migrate to more secure alternatives such as [IAM](https:\/\/docs.cloud.google.com\/iam\/docs\/grant-role-console) policies and [short-lived service account credentials](https:\/\/docs.cloud.google.com\/iam\/docs\/service-account-creds#short-lived-credentials), following least-privilege security practices. Read more about [the risks of API keys bound to service accounts](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys-best-practices#service-accounts-api-keys).\n\nBinding keys to a service account is prevented by a default organization policy constraint. To change this, see [**Enable key binding to service accounts**](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#enable-key-binding).\n\n**Note:** Requests authenticated by API keys bound to service accounts aren't recorded in [service account usage metrics](https:\/\/docs.cloud.google.com\/iam\/docs\/service-account-monitoring).\n\n### API key components\nAn API key has the following components, which let you manage and use the key:\n\nString\n\nThe API key string is an encrypted string, for example, `AIzaSyDaGmWKa4JsXZ-HjGw7ISLn_3namBGewQe`. When you use an API key to access an API, you always use the key's string. API keys don't have an associated JSON file.\n\nID\n\nThe API key ID is used by Google Cloud administrative tools to uniquely identify the key. The key ID can't be used to access APIs. The key ID can be found in the URL of the key's edit page in the Google Cloud console. You can also get the key ID by using the Google Cloud CLI to list the keys in your project.\n\nDisplay name\n\nThe display name is an optional, descriptive name for the key, which you can set when you create or update the key.\n\nBound service account\n\nAPI keys that are bound to a service account include the service account's email address.\n## Before you begin\nComplete the following tasks to use the samples on this page.\n\n### Set up authentication\nSelect the tab for how you plan to use the samples on this page:\n\n### Console\nWhen you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication.\n\n### gcloud\nIn the Google Cloud console, activate Cloud Shell.\n\n[Activate Cloud Shell](https:\/\/console.cloud.google.com\/?cloudshell=true)\n\nAt the bottom of the Google Cloud console, a [Cloud Shell](https:\/\/docs.cloud.google.com\/shell\/docs\/how-cloud-shell-works) session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.\n\n### C++\nTo use the C++ samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.\n\n1. [Install](https:\/\/docs.cloud.google.com\/sdk\/docs\/install) the Google Cloud CLI.\n2. If you're using an external identity provider (IdP), you must first  [sign in to the gcloud CLI with your federated identity](https:\/\/docs.cloud.google.com\/iam\/docs\/workforce-log-in-gcloud).\n3. If you're using a local shell, then create local authentication credentials for your user account:\n   ```\n   gcloud auth application-default login\n   ```\n   You don't need to do this if you're using Cloud Shell.\n   If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have  [signed in to the gcloud CLI with your federated identity](https:\/\/docs.cloud.google.com\/iam\/docs\/workforce-log-in-gcloud).\n\nFor more information, see  [Set up ADC for a local development environment](https:\/\/docs.cloud.google.com\/docs\/authentication\/set-up-adc-local-dev-environment) in the Google Cloud authentication documentation.\n\n### Java\nTo use the Java samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.\n\n1. [Install](https:\/\/docs.cloud.google.com\/sdk\/docs\/install) the Google Cloud CLI.\n2. If you're using an external identity provider (IdP), you must first  [sign in to the gcloud CLI with your federated identity](https:\/\/docs.cloud.google.com\/iam\/docs\/workforce-log-in-gcloud).\n3. If you're using a local shell, then create local authentication credentials for your user account:\n   ```\n   gcloud auth application-default login\n   ```\n   You don't need to do this if you're using Cloud Shell.\n   If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have  [signed in to the gcloud CLI with your federated identity](https:\/\/docs.cloud.google.com\/iam\/docs\/workforce-log-in-gcloud).\n\nFor more information, see  [Set up ADC for a local development environment](https:\/\/docs.cloud.google.com\/docs\/authentication\/set-up-adc-local-dev-environment) in the Google Cloud authentication documentation.\n\n### Python\nTo use the Python samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.\n\n1. [Install](https:\/\/docs.cloud.google.com\/sdk\/docs\/install) the Google Cloud CLI.\n2. If you're using an external identity provider (IdP), you must first  [sign in to the gcloud CLI with your federated identity](https:\/\/docs.cloud.google.com\/iam\/docs\/workforce-log-in-gcloud).\n3. If you're using a local shell, then create local authentication credentials for your user account:\n   ```\n   gcloud auth application-default login\n   ```\n   You don't need to do this if you're using Cloud Shell.\n   If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have  [signed in to the gcloud CLI with your federated identity](https:\/\/docs.cloud.google.com\/iam\/docs\/workforce-log-in-gcloud).\n\nFor more information, see  [Set up ADC for a local development environment](https:\/\/docs.cloud.google.com\/docs\/authentication\/set-up-adc-local-dev-environment) in the Google Cloud authentication documentation.\n\n### REST\nTo use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI.\n\nFor more information, see [Authenticate for using REST](https:\/\/docs.cloud.google.com\/docs\/authentication\/rest) in the Google Cloud authentication documentation.\n### Required roles\nTo get the permissions that you need to manage API keys, ask your administrator to grant you the following IAM roles on your project:\n\n- [API Keys Admin](https:\/\/docs.cloud.google.com\/iam\/docs\/roles-permissions\/serviceusage#serviceusage.apiKeysAdmin)  (`roles\/serviceusage.apiKeysAdmin`)\n- Restrict an API key to specific APIs by using the Google Cloud console: [Service Usage Viewer](https:\/\/docs.cloud.google.com\/iam\/docs\/roles-permissions\/serviceusage#serviceusage.serviceUsageViewer)  (`roles\/serviceusage.serviceUsageViewer`)\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](https:\/\/docs.cloud.google.com\/iam\/docs\/granting-changing-revoking-access).\n\nYou might also be able to get the required permissions through [custom roles](https:\/\/docs.cloud.google.com\/iam\/docs\/creating-custom-roles) or other [predefined roles](https:\/\/docs.cloud.google.com\/iam\/docs\/roles-overview#predefined).\n\n### Enable key binding to service accounts\nBefore you can [bind an API key to a service account](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#api-keys-bound-sa), you first need to set the `constraints\/iam.managed.disableServiceAccountApiKeyCreation` organization policy constraint to `false`. Changing the organization policy requires an associated [organization resource](https:\/\/docs.cloud.google.com\/resource-manager\/docs\/cloud-platform-resource-hierarchy#organizations). Projects without an organization aren't supported.\n\nTo change the policy constraint, complete the following instructions.\n\n### Console\n1. In the Google Cloud console, go to the **Organization policies** page.\n   [Go to Organization policies](https:\/\/console.cloud.google.com\/iam-admin\/orgpolicies\/list)\n2. Switch to the organization, folder, or project you want to change the policies for.\n3. In the **Filter** box, enter `Block service`, and then click the filter name **Block service account API key bindings**.\n4. Click **Manage policy**.\n5. In the **Policy source** section, select **Override parent's policy**.\n6. Click **Add a rule**, and set **Enforcement** to **Off**.\n7. Click **Done**.\n8. Optional: Click **Test changes** to give you insight on how the proposed policy might cause compliance violations or disruptions.\n9. Click **Set policy**.\n\n### gcloud\n1. Create a file named `spec.yaml`, with the following content:\n   ```\n   name: SCOPE\/ SCOPE_ID \/policies\/iam.managed.disableServiceAccountApiKeyCreation spec:  rules:  - enforce: false\n   ```\n   Provide the following values:\n   - `SCOPE`: Either `organizations`, `folders`, or `projects`.\n   - `SCOPE_ID`: Depending on SCOPE, the ID of the organization, folder, or project to which the organization policy applies.\n2. Run the following `gcloud` command to allow binding of API keys to service accounts:\n   ```\n   gcloud org-policies set-policy spec.yaml \\\n    --update-mask spec\n   ```\n## Create an API key\nTo create an API key, use one of the following options:\n\n### Console\n1. In the Google Cloud console, go to the **Credentials** page:\n   [Go to Credentials](https:\/\/console.cloud.google.com\/apis\/credentials)\n2. Click **Create credentials**, and then select **API key** from the menu.\n3. Optional: To bind the API key to a service account, select the **Authenticate API calls through a service account** checkbox and then click **Select a service account** to select the service account you want to bind to the key.\n   For more information, see [API keys bound to a service account](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#api-keys-bound-sa).\n4. Add API key restrictions.\n   Restricting API keys is a best practice. For more information, see [Apply API key restrictions](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#api_key_restrictions).\n5. Click **Create**. The **API key created** dialog displays the string for your newly created key.\n\n### gcloud\nYou use the [`gcloud services api-keys create` command](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/create) to create an API key.\n\nReplace `DISPLAY_NAME` with a descriptive name for your key.\n```\n gcloud services api-keys create \\\n     --display-name=DISPLAY_NAME\n```\nOptional: To bind the API key to a service account, use `gcloud beta` instead, with the `--service-account` flag:\n```\n gcloud beta services api-keys create \\\n     --display-name=DISPLAY_NAME \\\n     --service-account=SERVICE_ACCOUNT_EMAIL_ADDRESS\n```\nFor more information, see [API keys bound to a service account](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#api-keys-bound-sa).\n\n### C++\nTo run this sample, you must install the [API Keys client library](https:\/\/docs.cloud.google.com\/cpp\/docs\/reference\/apikeys\/latest).\n```\n#include \"google\/cloud\/apikeys\/v2\/api_keys_client.h\"\n#include \"google\/cloud\/location.h\"\n\ngoogle::api::apikeys::v2::Key CreateApiKey(\n    google::cloud::apikeys_v2::ApiKeysClient client,\n    google::cloud::Location location, std::string display_name) {\n  google::api::apikeys::v2::CreateKeyRequest request;\n  request.set_parent(location.FullName());\n  request.mutable_key()->set_display_name(std::move(display_name));\n  \/\/ As an example, restrict the API key's scope to the Natural Language API.\n  request.mutable_key()->mutable_restrictions()->add_api_targets()->set_service(\n      \"language.googleapis.com\");\n\n  \/\/ Create the key, blocking on the result.\n  auto key = client.CreateKey(request).get();\n  if (!key) throw std::move(key.status());\n  std::cout << \"Successfully created an API key: \" << key->name() << \"\\n\";\n\n  \/\/ For authenticating with the API key, use the value in `key->key_string()`.\n\n  \/\/ The API key's resource name is the value in `key->name()`. Use this to\n  \/\/ refer to the specific key in a `GetKey()` or `DeleteKey()` RPC.\n  return *key;\n}\n```\n\n### Java\nTo run this sample, you must install the [`google-cloud-apikeys` client library](https:\/\/docs.cloud.google.com\/java\/docs\/reference\/google-cloud-apikeys\/latest\/overview).\n```\n\nimport com.google.api.apikeys.v2.ApiKeysClient;\nimport com.google.api.apikeys.v2.ApiTarget;\nimport com.google.api.apikeys.v2.CreateKeyRequest;\nimport com.google.api.apikeys.v2.Key;\nimport com.google.api.apikeys.v2.LocationName;\nimport com.google.api.apikeys.v2.Restrictions;\nimport java.io.IOException;\nimport java.util.concurrent.ExecutionException;\nimport java.util.concurrent.TimeUnit;\nimport java.util.concurrent.TimeoutException;\n\npublic class CreateApiKey {\n\n  public static void main(String[] args)\n      throws IOException, ExecutionException, InterruptedException, TimeoutException {\n    \/\/ TODO(Developer): Before running this sample,\n    \/\/  1. Replace the variable(s) below.\n    \/\/  2. Set up ADC as described in https:\/\/cloud.google.com\/docs\/authentication\/external\/set-up-adc\n    \/\/  3. Make sure you have the necessary permission to create API keys.\n    String projectId = \"GOOGLE_CLOUD_PROJECT_ID\";\n\n    createApiKey(projectId);\n  }\n\n  \/\/ Creates an API key.\n  public static void createApiKey(String projectId)\n      throws IOException, ExecutionException, InterruptedException, TimeoutException {\n    \/\/ Initialize client that will be used to send requests. This client only needs to be created\n    \/\/ once, and can be reused for multiple requests. After completing all of your requests, call\n    \/\/ the `apiKeysClient.close()` method on the client to safely\n    \/\/ clean up any remaining background resources.\n    try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) {\n\n      Key key = Key.newBuilder()\n          .setDisplayName(\"My first API key\")\n          \/\/ Set the API key restriction.\n          \/\/ You can also set browser\/ server\/ android\/ ios based restrictions.\n          \/\/ For more information on API key restriction, see:\n          \/\/ https:\/\/cloud.google.com\/docs\/authentication\/api-keys#api_key_restrictions\n          .setRestrictions(Restrictions.newBuilder()\n              \/\/ Restrict the API key usage by specifying the target service and methods.\n              \/\/ The API key can only be used to authenticate the specified methods in the service.\n              .addApiTargets(ApiTarget.newBuilder()\n                  .setService(\"translate.googleapis.com\")\n                  .addMethods(\"translate.googleapis.com.TranslateText\")\n                  .build())\n              .build())\n          .build();\n\n      \/\/ Initialize request and set arguments.\n      CreateKeyRequest createKeyRequest = CreateKeyRequest.newBuilder()\n          \/\/ API keys can only be global.\n          .setParent(LocationName.of(projectId, \"global\").toString())\n          .setKey(key)\n          .build();\n\n      \/\/ Make the request and wait for the operation to complete.\n      Key result = apiKeysClient.createKeyAsync(createKeyRequest).get(3, TimeUnit.MINUTES);\n\n      \/\/ For authenticating with the API key, use the value in \"result.getKeyString()\".\n      \/\/ To restrict the usage of this API key, use the value in \"result.getName()\".\n      System.out.printf(\"Successfully created an API key: %s\", result.getName());\n    }\n  }\n}\n```\n\n### Python\nTo run this sample, you must install the [API Keys client library](https:\/\/docs.cloud.google.com\/python\/docs\/reference\/apikeys\/latest).\n```\n\nfrom google.cloud import api_keys_v2\nfrom google.cloud.api_keys_v2 import Key\n\n\ndef create_api_key(project_id: str, suffix: str) -> Key:\n    \"\"\"\n    Creates and restrict an API key. Add the suffix for uniqueness.\n\n    TODO(Developer):\n    1. Before running this sample,\n      set up ADC as described in https:\/\/cloud.google.com\/docs\/authentication\/external\/set-up-adc\n    2. Make sure you have the necessary permission to create API keys.\n\n    Args:\n        project_id: Google Cloud project id.\n\n    Returns:\n        response: Returns the created API Key.\n    \"\"\"\n    # Create the API Keys client.\n    client = api_keys_v2.ApiKeysClient()\n\n    key = api_keys_v2.Key()\n    key.display_name = f\"My first API key - {suffix}\"\n\n    # Initialize request and set arguments.\n    request = api_keys_v2.CreateKeyRequest()\n    request.parent = f\"projects\/{project_id}\/locations\/global\"\n    request.key = key\n\n    # Make the request and wait for the operation to complete.\n    response = client.create_key(request=request).result()\n\n    print(f\"Successfully created an API key: {response.name}\")\n    # For authenticating with the API key, use the value in \"response.key_string\".\n    # To restrict the usage of this API key, use the value in \"response.name\".\n    return response\n```\n\n### REST\nYou use the [`keys.create` method](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/projects.locations.keys\/create) to create an API key. This request returns a [long-running operation](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#lro); you must poll the operation to get the information for the new key.\n\nReplace the following values:\n\n- `DISPLAY_NAME`: Optional. A descriptive name for your key.\n- `PROJECT_ID`: Your Google Cloud project ID or name.\n```\ncurl -X POST \\\n-H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n-H \"Content-Type: application\/json; charset=utf-8\" \\\n-d {'\"displayName\" : \" DISPLAY_NAME \"'} \\\n\"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT \/locations\/global\/keys\"\n```\nOptional: To bind the API key to a service account instead, use the following command:\n```\ncurl -X POST \\\n-H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n-H \"Content-Type: application\/json; charset=utf-8\" \\\n-d {'\"displayName\" : \" DISPLAY_NAME \",\n     \"serviceAccountEmail\" : \" SERVICE_ACCOUNT_EMAIL \"'} \\\n\"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT \/locations\/global\/keys\"\n```\nFor more information, see [API keys bound to a service account](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#api-keys-bound-sa).\n\nFor more information about creating API keys using the REST API, see [Creating an API key](https:\/\/docs.cloud.google.com\/api-keys\/docs\/create-manage-api-keys#create) in the API Keys API documentation.\n\n**Important:** Copy your key string and keep it secure. Use API key restrictions to limit how the key can be used.\n\n## Apply API key restrictions\nAPI keys are unrestricted by default. Unrestricted keys are insecure because they can be used by anyone from anywhere. For production applications, you should set both [application restrictions](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#adding-application-restrictions) and [API restrictions](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#adding-api-restrictions).\n\n### Add application restrictions\nApplication restrictions specify which websites, IP addresses, or apps can use an API key.\n\nYou can apply only one application restriction type at a time. Choose the restriction type based on your application type:\n\n| Option | Application type | Notes |\n|---|---|---|\n| [HTTP referrers](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#http) | Web applications | Specifies the websites that can use the key. |\n| [IP Addresses](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#ip) | Applications called by specific servers | Specifies the servers or cron jobs that can use the key. This is the only restriction available if you bind your API key to a service account. |\n| [Android apps](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#android) | Android applications | Specifies the Android application that can use the key. |\n| [iOS apps](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#ios) | iOS applications | Specifies the iOS bundles that can use the key. |\n#### HTTP referrers\nTo restrict the websites that can use your API key, you add one or more HTTP referrer restrictions.\n\nYou can substitute a wildcard character (`*`) for the subdomain or the path, but you can't insert a wildcard character into the middle of the URL. For example, `*.example.com` is valid, and accepts all sites ending in `.example.com`. However, `mysubdomain*.example.com` is not a valid restriction.\n\nPort numbers can be included in HTTP referrer restrictions. If you include a port number, then only requests using that port are matched. If you don't specify a port number, then requests from any port number are matched.\n\nThe following table shows some example scenarios and browser restrictions:\n\n| **Scenario** | **Restrictions** |\n|---|---|\n| Allow a specific URL | Add a URL with an exact path. For example:  `www.example.com\/path`  `www.example.com\/path\/path`  Some browsers implement a  [referrer policy](https:\/\/developer.chrome.com\/blog\/referrer-policy-new-chrome-default\/) that sends only the origin URL for cross-origin requests. Users of these browsers can't use keys with page-specific URL restrictions. |\n| Allow any URL in your site | You must set two URLs in the `allowedReferers` list.  URL for the domain, without a subdomain, and with a wildcard for the path. For example:  `example.com\/*` A second URL that includes a wildcard for the subdomain and a wildcard for the path. For example:  `*.example.com\/*` |\n| Allow any URL in a single subdomain or naked domain | You must set two URLs in the `allowedReferers` list to allow an entire domain: URL for the domain, without a trailing slash. For example:  `www.example.com`  `sub.example.com`  `example.com` A second URL for the domain that includes a wildcard for the path. For example:  `www.example.com\/*`  `sub.example.com\/*`  `example.com\/*` |\n\nTo restrict your API key to specific websites, use one of the following options:\n\n### Console\n1. In the Google Cloud console, go to the **Credentials** page:\n   [Go to Credentials](https:\/\/console.cloud.google.com\/apis\/credentials)\n2. Click the name of the API key that you want to restrict.\n3. In the **Application restrictions** section, select **HTTP referrers**.\n4. For each restriction that you want to add, click **Add an item**, enter the restriction, and click **Done**.\n5. Click **Save** to save your changes and return to the API key list.\n\n### gcloud\n1. Get the ID of the key that you want to restrict.\n   The ID is not the same as the display name or the key string. You can get the ID by using the [`gcloud services api-keys list` command](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/list) to list the keys in your project.\n2. Use the [`gcloud services api-keys update` command](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/update) to add HTTP referrer restrictions to an API key.\n   Replace the following values:\n   - `KEY_ID`: The ID of the key that you want to restrict.\n   - `ALLOWED_REFERRER_1`: Your HTTP referrer restriction.\n     You can add as many restrictions as needed; use commas to separate the restrictions. You must provide all referrer restrictions with the update command; the referrer restrictions provided replace any existing referrer restrictions on the key.\n   ```\n   gcloud services api-keys update KEY_ID \\\n --allowed-referrers=\" ALLOWED_REFERRER_1 \"\n   ```\n\n### Java\nTo run this sample, you must install the [`google-cloud-apikeys` client library](https:\/\/docs.cloud.google.com\/java\/docs\/reference\/google-cloud-apikeys\/latest\/overview).\n```\n\nimport com.google.api.apikeys.v2.ApiKeysClient;\nimport com.google.api.apikeys.v2.BrowserKeyRestrictions;\nimport com.google.api.apikeys.v2.Key;\nimport com.google.api.apikeys.v2.Restrictions;\nimport com.google.api.apikeys.v2.UpdateKeyRequest;\nimport com.google.protobuf.FieldMask;\nimport java.io.IOException;\nimport java.util.concurrent.ExecutionException;\nimport java.util.concurrent.TimeUnit;\nimport java.util.concurrent.TimeoutException;\n\npublic class RestrictApiKeyHttp {\n\n  public static void main(String[] args)\n      throws IOException, ExecutionException, InterruptedException, TimeoutException {\n    \/\/ TODO(Developer): Before running this sample,\n    \/\/  1. Replace the variable(s) below.\n    String projectId = \"GOOGLE_CLOUD_PROJECT_ID\";\n\n    \/\/ ID of the key to restrict. This ID is auto-created during key creation.\n    \/\/ This is different from the key string. To obtain the key_id,\n    \/\/ you can also use the lookup api: client.lookupKey()\n    String keyId = \"key_id\";\n\n    restrictApiKeyHttp(projectId, keyId);\n  }\n\n  \/\/ Restricts an API key. To restrict the websites that can use your API key,\n  \/\/ you add one or more HTTP referrer restrictions.\n  public static void restrictApiKeyHttp(String projectId, String keyId)\n      throws IOException, ExecutionException, InterruptedException, TimeoutException {\n    \/\/ Initialize client that will be used to send requests. This client only needs to be created\n    \/\/ once, and can be reused for multiple requests. After completing all of your requests, call\n    \/\/ the `apiKeysClient.close()` method on the client to safely\n    \/\/ clean up any remaining background resources.\n    try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) {\n\n      \/\/ Restrict the API key usage to specific websites by adding them\n      \/\/ to the list of allowed_referrers.\n      Restrictions restrictions = Restrictions.newBuilder()\n          .setBrowserKeyRestrictions(BrowserKeyRestrictions.newBuilder()\n              .addAllowedReferrers(\"www.example.com\/*\")\n              .build())\n          .build();\n\n      Key key = Key.newBuilder()\n          .setName(String.format(\"projects\/%s\/locations\/global\/keys\/%s\", projectId, keyId))\n          \/\/ Set the restriction(s).\n          \/\/ For more information on API key restriction, see:\n          \/\/ https:\/\/cloud.google.com\/docs\/authentication\/api-keys\n          .setRestrictions(restrictions)\n          .build();\n\n      \/\/ Initialize request and set arguments.\n      UpdateKeyRequest updateKeyRequest = UpdateKeyRequest.newBuilder()\n          .setKey(key)\n          .setUpdateMask(FieldMask.newBuilder().addPaths(\"restrictions\").build())\n          .build();\n\n      \/\/ Make the request and wait for the operation to complete.\n      Key result = apiKeysClient.updateKeyAsync(updateKeyRequest).get(3, TimeUnit.MINUTES);\n\n      \/\/ For authenticating with the API key, use the value in \"result.getKeyString()\".\n      System.out.printf(\"Successfully updated the API key: %s\", result.getName());\n    }\n  }\n}\n```\n\n### Python\nTo run this sample, you must install the [API Keys client library](https:\/\/docs.cloud.google.com\/python\/docs\/reference\/apikeys\/latest).\n```\n\nfrom google.cloud import api_keys_v2\nfrom google.cloud.api_keys_v2 import Key\n\n\ndef restrict_api_key_http(project_id: str, key_id: str) -> Key:\n    \"\"\"\n    Restricts an API key. To restrict the websites that can use your API key,\n    you add one or more HTTP referrer restrictions.\n\n    TODO(Developer): Replace the variables before running this sample.\n\n    Args:\n        project_id: Google Cloud project id.\n        key_id: ID of the key to restrict. This ID is auto-created during key creation.\n            This is different from the key string. To obtain the key_id,\n            you can also use the lookup api: client.lookup_key()\n\n    Returns:\n        response: Returns the updated API Key.\n    \"\"\"\n\n    # Create the API Keys client.\n    client = api_keys_v2.ApiKeysClient()\n\n    # Restrict the API key usage to specific websites by adding them to the list of allowed_referrers.\n    browser_key_restrictions = api_keys_v2.BrowserKeyRestrictions()\n    browser_key_restrictions.allowed_referrers = [\"www.example.com\/*\"]\n\n    # Set the API restriction.\n    # For more information on API key restriction, see:\n    # https:\/\/cloud.google.com\/docs\/authentication\/api-keys\n    restrictions = api_keys_v2.Restrictions()\n    restrictions.browser_key_restrictions = browser_key_restrictions\n\n    key = api_keys_v2.Key()\n    key.name = f\"projects\/{project_id}\/locations\/global\/keys\/{key_id}\"\n    key.restrictions = restrictions\n\n    # Initialize request and set arguments.\n    request = api_keys_v2.UpdateKeyRequest()\n    request.key = key\n    request.update_mask = \"restrictions\"\n\n    # Make the request and wait for the operation to complete.\n    response = client.update_key(request=request).result()\n\n    print(f\"Successfully updated the API key: {response.name}\")\n    # Use response.key_string to authenticate.\n    return response\n```\n\n### REST\n1. Get the ID of the key that you want to restrict.\n   The ID is not the same as the display name or the key string. You can get the ID by using the [keys.list](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/projects.locations.keys\/list) method. The ID is listed in the `uid` field of the response.\n   Replace `PROJECT_ID` with your Google Cloud project ID or name.\n   ```\n   curl -X GET \\\n-H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n\"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/\"\n   ```\n2. Use the [keys.patch](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/projects.locations.keys\/patch) method to add HTTP referrer restrictions to the API key.\n   This request returns a [long-running operation](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#lro); you must poll the operation to know when the operation completes and get the operation status.\n   Replace the following values:\n   - `ALLOWED_REFERRER_1`: Your HTTP referrer restriction.\n     You can add as many restrictions as needed; use commas to separate the restrictions. You must provide all referrer restrictions with the request; the referrer restrictions provided replace any existing referrer restrictions on the key.\n   - `PROJECT_ID`: Your Google Cloud project ID or name.\n   - `KEY_ID`: The ID of the key that you want to restrict.\n   ```\n   curl -X PATCH \\\n-H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n-H \"Content-Type: application\/json; charset=utf-8\" \\\n--data '{\n\"restrictions\" : {\n\"browserKeyRestrictions\": {\n  \"allowedReferrers\": [\" ALLOWED_REFERRER_1 \"]\n}\n}\n}' \\\n\"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/ KEY_ID ?updateMask=restrictions\"\n   ```\n\nFor more information about adding HTTP referrer restrictions to a key using the REST API, see [Adding browser restrictions](https:\/\/docs.cloud.google.com\/api-keys\/docs\/add-restrictions-api-keys#adding_browser_restrictions) in the API Keys API documentation.\n#### IP Addresses\nYou can specify one or more IP addresses of the callers, such as a web server or cron job, that are allowed to use your API key. You can specify the IP addresses in any of the following formats:\n\n- IPv4 (`198.51.100.1`)\n- IPv6 (`2001:db8::1`)\n- A subnet using CIDR notation (`198.51.100.0\/24`, `2001:db8::\/64`)\n\nUsing `localhost` is not supported for server restrictions.\n\nTo restrict your API key to specific IP addresses, use one of the following options:\n\n### Console\n1. In the Google Cloud console, go to the **Credentials** page:\n   [Go to Credentials](https:\/\/console.cloud.google.com\/apis\/credentials)\n2. Click the name of the API key that you want to restrict.\n3. In the **Application restrictions** section, select **IP addresses**.\n4. For each IP address that you want to add, click **Add an item**, enter the address, and click **Done**.\n5. Click **Save** to save your changes and return to the API key list.\n\n### gcloud\n1. Get the ID of the key that you want to restrict.\n   The ID is not the same as the display name or the key string. You can get the ID by using the [`gcloud services api-keys list` command](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/list) to list the keys in your project.\n2. Use the [`gcloud services api-keys update` command](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/update) to add server (IP address) restrictions to an API key.\n   Replace the following values:\n   - `KEY_ID`: The ID of the key that you want to restrict.\n   - `ALLOWED_IP_ADDR_1`: Your allowed IP address.\n     You can add as many IP addresses as needed; use commas to separate the addresses.\n   ```\n   gcloud services api-keys update KEY_ID \\\n--allowed-ips=\" ALLOWED_IP_ADDR_1 \"\n   ```\n\n### Java\nTo run this sample, you must install the [`google-cloud-apikeys` client library](https:\/\/docs.cloud.google.com\/java\/docs\/reference\/google-cloud-apikeys\/latest\/overview).\n```\n\nimport com.google.api.apikeys.v2.ApiKeysClient;\nimport com.google.api.apikeys.v2.Key;\nimport com.google.api.apikeys.v2.Restrictions;\nimport com.google.api.apikeys.v2.ServerKeyRestrictions;\nimport com.google.api.apikeys.v2.UpdateKeyRequest;\nimport com.google.protobuf.FieldMask;\nimport java.io.IOException;\nimport java.util.Arrays;\nimport java.util.concurrent.ExecutionException;\nimport java.util.concurrent.TimeUnit;\nimport java.util.concurrent.TimeoutException;\n\npublic class RestrictApiKeyServer {\n\n  public static void main(String[] args)\n      throws IOException, ExecutionException, InterruptedException, TimeoutException {\n    \/\/ TODO(Developer): Before running this sample,\n    \/\/  1. Replace the variable(s) below.\n    String projectId = \"GOOGLE_CLOUD_PROJECT_ID\";\n\n    \/\/ ID of the key to restrict. This ID is auto-created during key creation.\n    \/\/ This is different from the key string. To obtain the key_id,\n    \/\/ you can also use the lookup api: client.lookupKey()\n    String keyId = \"key_id\";\n\n    restrictApiKeyServer(projectId, keyId);\n  }\n\n  \/\/ Restricts the API key based on IP addresses. You can specify one or more IP addresses\n  \/\/ of the callers, for example web servers or cron jobs, that are allowed to use your API key.\n  public static void restrictApiKeyServer(String projectId, String keyId)\n      throws IOException, ExecutionException, InterruptedException, TimeoutException {\n    \/\/ Initialize client that will be used to send requests. This client only needs to be created\n    \/\/ once, and can be reused for multiple requests. After completing all of your requests, call\n    \/\/ the `apiKeysClient.close()` method on the client to safely\n    \/\/ clean up any remaining background resources.\n    try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) {\n\n      \/\/ Restrict the API key usage by specifying the IP addresses.\n      \/\/ You can specify the IP addresses in IPv4 or IPv6 or a subnet using CIDR notation.\n      Restrictions restrictions = Restrictions.newBuilder()\n          .setServerKeyRestrictions(ServerKeyRestrictions.newBuilder()\n              .addAllAllowedIps(Arrays.asList(\"198.51.100.0\/24\", \"2000:db8::\/64\"))\n              .build())\n          .build();\n\n      Key key = Key.newBuilder()\n          .setName(String.format(\"projects\/%s\/locations\/global\/keys\/%s\", projectId, keyId))\n          \/\/ Set the restriction(s).\n          \/\/ For more information on API key restriction, see:\n          \/\/ https:\/\/cloud.google.com\/docs\/authentication\/api-keys\n          .setRestrictions(restrictions)\n          .build();\n\n      \/\/ Initialize request and set arguments.\n      UpdateKeyRequest updateKeyRequest = UpdateKeyRequest.newBuilder()\n          .setKey(key)\n          .setUpdateMask(FieldMask.newBuilder().addPaths(\"restrictions\").build())\n          .build();\n\n      \/\/ Make the request and wait for the operation to complete.\n      Key result = apiKeysClient.updateKeyAsync(updateKeyRequest).get(3, TimeUnit.MINUTES);\n\n      \/\/ For authenticating with the API key, use the value in \"result.getKeyString()\".\n      System.out.printf(\"Successfully updated the API key: %s\", result.getName());\n    }\n  }\n}\n```\n\n### Python\nTo run this sample, you must install the [API Keys client library](https:\/\/docs.cloud.google.com\/python\/docs\/reference\/apikeys\/latest).\n```\n\nfrom google.cloud import api_keys_v2\nfrom google.cloud.api_keys_v2 import Key\n\n\ndef restrict_api_key_server(project_id: str, key_id: str) -> Key:\n    \"\"\"\n    Restricts the API key based on IP addresses. You can specify one or more IP addresses of the callers,\n    for example web servers or cron jobs, that are allowed to use your API key.\n\n    TODO(Developer): Replace the variables before running this sample.\n\n    Args:\n        project_id: Google Cloud project id.\n        key_id: ID of the key to restrict. This ID is auto-created during key creation.\n            This is different from the key string. To obtain the key_id,\n            you can also use the lookup api: client.lookup_key()\n\n    Returns:\n        response: Returns the updated API Key.\n    \"\"\"\n\n    # Create the API Keys client.\n    client = api_keys_v2.ApiKeysClient()\n\n    # Restrict the API key usage by specifying the IP addresses.\n    # You can specify the IP addresses in IPv4 or IPv6 or a subnet using CIDR notation.\n    server_key_restrictions = api_keys_v2.ServerKeyRestrictions()\n    server_key_restrictions.allowed_ips = [\"198.51.100.0\/24\", \"2000:db8::\/64\"]\n\n    # Set the API restriction.\n    # For more information on API key restriction, see:\n    # https:\/\/cloud.google.com\/docs\/authentication\/api-keys\n    restrictions = api_keys_v2.Restrictions()\n    restrictions.server_key_restrictions = server_key_restrictions\n\n    key = api_keys_v2.Key()\n    key.name = f\"projects\/{project_id}\/locations\/global\/keys\/{key_id}\"\n    key.restrictions = restrictions\n\n    # Initialize request and set arguments.\n    request = api_keys_v2.UpdateKeyRequest()\n    request.key = key\n    request.update_mask = \"restrictions\"\n\n    # Make the request and wait for the operation to complete.\n    response = client.update_key(request=request).result()\n\n    print(f\"Successfully updated the API key: {response.name}\")\n    # Use response.key_string to authenticate.\n    return response\n```\n\n### REST\n1. Get the ID of the key that you want to restrict.\n   The ID is not the same as the display name or the key string. You can get the ID by using the [keys.list](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/projects.locations.keys\/list) method. The ID is listed in the `uid` field of the response.\n   Replace `PROJECT_ID` with your Google Cloud project ID or name.\n   ```\n   curl -X GET \\\n-H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n\"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/\"\n   ```\n2. Use the [keys.patch](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/projects.locations.keys\/patch) method to add server (IP address) restrictions to an API key.\n   This request returns a [long-running operation](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#lro); you must poll the operation to know when the operation completes and get the operation status.\n   Replace the following values:\n   - `ALLOWED_IP_ADDR_1`: Your allowed IP address.\n     You can add as many IP addresses as needed; use commas to separate the restrictions. You must provide all IP addresses with the request; the referrer restrictions provided replace any existing IP address restrictions on the key.\n   - `PROJECT_ID`: Your Google Cloud project ID or name.\n   - `KEY_ID`: The ID of the key that you want to restrict.\n   ```\n   curl -X PATCH \\\n-H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n-H \"Content-Type: application\/json; charset=utf-8\" \\\n--data '{\n\"restrictions\" : {\n  \"serverKeyRestrictions\": {\n    \"allowedIps\": [\" ALLOWED_IP_ADDR_1 \"]\n  }\n}\n}' \\\n\"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/ KEY_ID ?updateMask=restrictions\"\n   ```\n\nFor more information about adding IP address restrictions to a key using the REST API, see [Adding server restrictions](https:\/\/docs.cloud.google.com\/api-keys\/docs\/add-restrictions-api-keys#adding_server_restrictions) in the API Keys API documentation.\n#### Android apps\nYou can restrict usage of an API key to specific Android apps. You must provide the package name and the 20-byte SHA-1 certificate fingerprint for each app.\n\nWhen you use the API key in a request, you must specify the package name and certificate fingerprint by using the following HTTP headers:\n\n- `X-Android-Package`\n- `X-Android-Cert`\n\n**Note:** Bypassing this restriction is straightforward. If you use this restriction, you should also add API restrictions and monitor usage carefully.\n\nTo restrict your API key to one or more Android apps, use one of the following options:\n\n### Console\n1. In the Google Cloud console, go to the **Credentials** page:\n   [Go to Credentials](https:\/\/console.cloud.google.com\/apis\/credentials)\n2. Click the name of the API key that you want to restrict.\n3. In the **Application restrictions** section, select **Android apps**.\n4. For each Android app that you want to add, click **Add an item** and enter the package name and SHA-1 certificate fingerprint, then click **Done**.\n5. Click **Save** to save your changes and return to the API key list.\n\n### gcloud\n1. Get the ID of the key that you want to restrict.\n   The ID is not the same as the display name or the key string. You can get the ID by using the [`gcloud services api-keys list` command](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/list) to list the keys in your project.\n2. Use the [`gcloud services api-keys update` command](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/update) to specify the Android apps that can use an API key.\n   Replace the following values:\n   - `KEY_ID`: The ID of the key that you want to restrict.\n   - `SHA1_FINGERPRINT` and `PACKAGE_NAME`: The app information for an Android app that can use the key.\n     You can add as many apps as needed; use additional `--allowed-application` flags.\n   ```\n   gcloud services api-keys update KEY_ID \\\n--allowed-application=sha1_fingerprint=SHA1_FINGERPRINT_1,package_name=PACKAGE_NAME_1 \\\n--allowed-application=sha1_fingerprint=SHA1_FINGERPRINT_2,package_name=PACKAGE_NAME_2\n   ```\n\n### Java\nTo run this sample, you must install the [`google-cloud-apikeys` client library](https:\/\/docs.cloud.google.com\/java\/docs\/reference\/google-cloud-apikeys\/latest\/overview).\n```\n\nimport com.google.api.apikeys.v2.AndroidApplication;\nimport com.google.api.apikeys.v2.AndroidKeyRestrictions;\nimport com.google.api.apikeys.v2.ApiKeysClient;\nimport com.google.api.apikeys.v2.Key;\nimport com.google.api.apikeys.v2.Restrictions;\nimport com.google.api.apikeys.v2.UpdateKeyRequest;\nimport com.google.protobuf.FieldMask;\nimport java.io.IOException;\nimport java.util.concurrent.ExecutionException;\nimport java.util.concurrent.TimeUnit;\nimport java.util.concurrent.TimeoutException;\n\npublic class RestrictApiKeyAndroid {\n\n  public static void main(String[] args)\n      throws IOException, ExecutionException, InterruptedException, TimeoutException {\n    \/\/ TODO(Developer): Before running this sample,\n    \/\/  1. Replace the variable(s) below.\n    String projectId = \"GOOGLE_CLOUD_PROJECT_ID\";\n\n    \/\/ ID of the key to restrict. This ID is auto-created during key creation.\n    \/\/ This is different from the key string. To obtain the key_id,\n    \/\/ you can also use the lookup api: client.lookupKey()\n    String keyId = \"key_id\";\n\n    restrictApiKeyAndroid(projectId, keyId);\n  }\n\n  \/\/ Restricts an API key based on android applications.\n  \/\/ Specifies the Android application that can use the key.\n  public static void restrictApiKeyAndroid(String projectId, String keyId)\n      throws IOException, ExecutionException, InterruptedException, TimeoutException {\n    \/\/ Initialize client that will be used to send requests. This client only needs to be created\n    \/\/ once, and can be reused for multiple requests. After completing all of your requests, call\n    \/\/ the `apiKeysClient.close()` method on the client to safely\n    \/\/ clean up any remaining background resources.\n    try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) {\n\n      \/\/ Restrict the API key usage by specifying the allowed android applications.\n      Restrictions restrictions = Restrictions.newBuilder()\n          .setAndroidKeyRestrictions(AndroidKeyRestrictions.newBuilder()\n              .addAllowedApplications(AndroidApplication.newBuilder()\n                  \/\/ Specify the android application's package name and SHA1 fingerprint.\n                  .setPackageName(\"com.google.appname\")\n                  .setSha1Fingerprint(\"0873D391E987982FBBD30873D391E987982FBBD3\")\n                  .build())\n              .build())\n          .build();\n\n      Key key = Key.newBuilder()\n          .setName(String.format(\"projects\/%s\/locations\/global\/keys\/%s\", projectId, keyId))\n          \/\/ Set the restriction(s).\n          \/\/ For more information on API key restriction, see:\n          \/\/ https:\/\/cloud.google.com\/docs\/authentication\/api-keys\n          .setRestrictions(restrictions)\n          .build();\n\n      \/\/ Initialize request and set arguments.\n      UpdateKeyRequest updateKeyRequest = UpdateKeyRequest.newBuilder()\n          .setKey(key)\n          .setUpdateMask(FieldMask.newBuilder().addPaths(\"restrictions\").build())\n          .build();\n\n      \/\/ Make the request and wait for the operation to complete.\n      Key result = apiKeysClient.updateKeyAsync(updateKeyRequest).get(3, TimeUnit.MINUTES);\n\n      \/\/ For authenticating with the API key, use the value in \"result.getKeyString()\".\n      System.out.printf(\"Successfully updated the API key: %s\", result.getName());\n    }\n  }\n}\n```\n\n### Python\nTo run this sample, you must install the [API Keys client library](https:\/\/docs.cloud.google.com\/python\/docs\/reference\/apikeys\/latest).\n```\n\nfrom google.cloud import api_keys_v2\nfrom google.cloud.api_keys_v2 import Key\n\n\ndef restrict_api_key_android(project_id: str, key_id: str) -> Key:\n    \"\"\"\n    Restricts an API key based on android applications.\n\n    Specifies the Android application that can use the key.\n\n    TODO(Developer): Replace the variables before running this sample.\n\n    Args:\n        project_id: Google Cloud project id.\n        key_id: ID of the key to restrict. This ID is auto-created during key creation.\n            This is different from the key string. To obtain the key_id,\n            you can also use the lookup api: client.lookup_key()\n\n    Returns:\n        response: Returns the updated API Key.\n    \"\"\"\n\n    # Create the API Keys client.\n    client = api_keys_v2.ApiKeysClient()\n\n    # Specify the android application's package name and SHA1 fingerprint.\n    allowed_application = api_keys_v2.AndroidApplication()\n    allowed_application.package_name = \"com.google.appname\"\n    allowed_application.sha1_fingerprint = \"0873D391E987982FBBD30873D391E987982FBBD3\"\n\n    # Restrict the API key usage by specifying the allowed applications.\n    android_key_restriction = api_keys_v2.AndroidKeyRestrictions()\n    android_key_restriction.allowed_applications = [allowed_application]\n\n    # Set the restriction(s).\n    # For more information on API key restriction, see:\n    # https:\/\/cloud.google.com\/docs\/authentication\/api-keys\n    restrictions = api_keys_v2.Restrictions()\n    restrictions.android_key_restrictions = android_key_restriction\n\n    key = api_keys_v2.Key()\n    key.name = f\"projects\/{project_id}\/locations\/global\/keys\/{key_id}\"\n    key.restrictions = restrictions\n\n    # Initialize request and set arguments.\n    request = api_keys_v2.UpdateKeyRequest()\n    request.key = key\n    request.update_mask = \"restrictions\"\n\n    # Make the request and wait for the operation to complete.\n    response = client.update_key(request=request).result()\n\n    print(f\"Successfully updated the API key: {response.name}\")\n    # Use response.key_string to authenticate.\n    return response\n```\n\n### REST\n1. Get the ID of the key that you want to restrict.\n   The ID is not the same as the display name or the key string. You can get the ID by using the [keys.list](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/projects.locations.keys\/list) method. The ID is listed in the `uid` field of the response.\n   Replace `PROJECT_ID` with your Google Cloud project ID or name.\n   ```\n   curl -X GET \\\n-H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n\"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/\"\n   ```\n2. Use the [keys.patch](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/projects.locations.keys\/patch) method to specify the Android apps that can use an API key.\n   This request returns a [long-running operation](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#lro); you must poll the operation to know when the operation completes and get the operation status.\n   Replace the following values:\n   - `SHA1_FINGERPRINT_1` and `PACKAGE_NAME_1`: The app information for an Android app that can use the key.\n     You can add the information for as many apps as needed; use commas to separate the [AndroidApplication](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/projects.locations.keys#AndroidApplication) objects. You must provide all applications with the request; the applications provided replace any existing allowed applications on the key.\n   - `PROJECT_ID`: Your Google Cloud project ID or name.\n   - `KEY_ID`: The ID of the key that you want to restrict.\n   ```\n   curl -X PATCH \\\n-H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n-H \"Content-Type: application\/json; charset=utf-8\" \\\n--data '{\n\"restrictions\" : {\n\"androidKeyRestrictions\": {\n  \"allowedApplications\": [\n    {\n      \"sha1Fingerprint\": \" SHA1_FINGERPRINT_1 \",\n      \"packageName\": \" PACKAGE_NAME_1 \"\n    },\n ]\n}\n}\n}' \\\n\"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/ KEY_ID ?updateMask=restrictions\"\n   ```\n\nFor more information about adding Android app restrictions to a key using the REST API, see [Adding Android restrictions](https:\/\/docs.cloud.google.com\/api-keys\/docs\/add-restrictions-api-keys#adding_android_restrictions) in the API Keys API documentation.\n#### iOS apps\nYou can restrict usage of an API key to specific iOS apps by providing the bundle ID of each app.\n\nWhen you use the API key in a request, you must specify the bundle ID by using the `X-Ios-Bundle-Identifier` HTTP header.\n\n**Note:** Bypassing this restriction is straightforward. If you use this restriction, you should also add API restrictions and monitor usage carefully.\n\nTo restrict your API key to one or more iOS apps, use one of the following options:\n\n### Console\n1. In the Google Cloud console, go to the **Credentials** page:\n   [Go to Credentials](https:\/\/console.cloud.google.com\/apis\/credentials)\n2. Click the name of the API key that you want to restrict.\n3. In the **Application restrictions** section, select **iOS apps**.\n4. For each iOS app that you want to add, click **Add an item** and enter the bundle ID, then click **Done**.\n5. Click **Save** to save your changes and return to the API key list.\n\n### gcloud\n1. Get the ID of the key that you want to restrict.\n   The ID is not the same as the display name or the key string. You can get the ID by using the [`gcloud services api-keys list` command](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/list) to list the keys in your project.\n2. Use the [`gcloud services api-keys update`](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/update) method to specify the iOS apps that can use the key.\n   Replace the following values:\n   - `KEY_ID`: The ID of the key that you want to restrict.\n   - `ALLOWED_BUNDLE_ID`: The bundle ID of an iOS app that you want to be able to use this API key.\n     You can add as many bundle IDs as needed; use commas to separate the IDs.\n   ```\n   gcloud services api-keys update KEY_ID \\\n--allowed-bundle-ids=ALLOWED_BUNDLE_ID_1,ALLOWED_BUNDLE_ID_2\n   ```\n\n### Java\nTo run this sample, you must install the [`google-cloud-apikeys` client library](https:\/\/docs.cloud.google.com\/java\/docs\/reference\/google-cloud-apikeys\/latest\/overview).\n```\n\nimport com.google.api.apikeys.v2.ApiKeysClient;\nimport com.google.api.apikeys.v2.IosKeyRestrictions;\nimport com.google.api.apikeys.v2.Key;\nimport com.google.api.apikeys.v2.Restrictions;\nimport com.google.api.apikeys.v2.UpdateKeyRequest;\nimport com.google.protobuf.FieldMask;\nimport java.io.IOException;\nimport java.util.Arrays;\nimport java.util.concurrent.ExecutionException;\nimport java.util.concurrent.TimeUnit;\nimport java.util.concurrent.TimeoutException;\n\npublic class RestrictApiKeyIos {\n\n  public static void main(String[] args)\n      throws IOException, ExecutionException, InterruptedException, TimeoutException {\n    \/\/ TODO(Developer): Before running this sample,\n    \/\/  1. Replace the variable(s) below.\n    String projectId = \"GOOGLE_CLOUD_PROJECT_ID\";\n\n    \/\/ ID of the key to restrict. This ID is auto-created during key creation.\n    \/\/ This is different from the key string. To obtain the key_id,\n    \/\/ you can also use the lookup api: client.lookupKey()\n    String keyId = \"key_id\";\n\n    restrictApiKeyIos(projectId, keyId);\n  }\n\n  \/\/ Restricts an API key. You can restrict usage of an API key to specific iOS apps\n  \/\/ by providing the bundle ID of each app.\n  public static void restrictApiKeyIos(String projectId, String keyId)\n      throws IOException, ExecutionException, InterruptedException, TimeoutException {\n    \/\/ Initialize client that will be used to send requests. This client only needs to be created\n    \/\/ once, and can be reused for multiple requests. After completing all of your requests, call\n    \/\/ the `apiKeysClient.close()` method on the client to safely\n    \/\/ clean up any remaining background resources.\n    try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) {\n\n      \/\/ Restrict the API key usage by specifying the bundle ID(s)\n      \/\/ of iOS app(s) that can use the key.\n      Restrictions restrictions = Restrictions.newBuilder()\n          .setIosKeyRestrictions(IosKeyRestrictions.newBuilder()\n              .addAllAllowedBundleIds(Arrays.asList(\"com.google.gmail\", \"com.google.drive\"))\n              .build())\n          .build();\n\n      Key key = Key.newBuilder()\n          .setName(String.format(\"projects\/%s\/locations\/global\/keys\/%s\", projectId, keyId))\n          \/\/ Set the restriction(s).\n          \/\/ For more information on API key restriction, see:\n          \/\/ https:\/\/cloud.google.com\/docs\/authentication\/api-keys\n          .setRestrictions(restrictions)\n          .build();\n\n      \/\/ Initialize request and set arguments.\n      UpdateKeyRequest updateKeyRequest = UpdateKeyRequest.newBuilder()\n          .setKey(key)\n          .setUpdateMask(FieldMask.newBuilder().addPaths(\"restrictions\").build())\n          .build();\n\n      \/\/ Make the request and wait for the operation to complete.\n      Key result = apiKeysClient.updateKeyAsync(updateKeyRequest).get(3, TimeUnit.MINUTES);\n\n      \/\/ For authenticating with the API key, use the value in \"result.getKeyString()\".\n      System.out.printf(\"Successfully updated the API key: %s\", result.getName());\n    }\n  }\n}\n```\n\n### Python\nTo run this sample, you must install the [API Keys client library](https:\/\/docs.cloud.google.com\/python\/docs\/reference\/apikeys\/latest).\n```\n\nfrom google.cloud import api_keys_v2\nfrom google.cloud.api_keys_v2 import Key\n\n\ndef restrict_api_key_ios(project_id: str, key_id: str) -> Key:\n    \"\"\"\n    Restricts an API key. You can restrict usage of an API key to specific iOS apps\n    by providing the bundle ID of each app.\n\n    TODO(Developer): Replace the variables before running this sample.\n\n    Args:\n        project_id: Google Cloud project id.\n        key_id: ID of the key to restrict. This ID is auto-created during key creation.\n            This is different from the key string. To obtain the key_id,\n            you can also use the lookup api: client.lookup_key()\n\n    Returns:\n        response: Returns the updated API Key.\n    \"\"\"\n\n    # Create the API Keys client.\n    client = api_keys_v2.ApiKeysClient()\n\n    # Restrict the API key usage by specifying the bundle ID(s) of iOS app(s) that can use the key.\n    ios_key_restrictions = api_keys_v2.IosKeyRestrictions()\n    ios_key_restrictions.allowed_bundle_ids = [\"com.google.gmail\", \"com.google.drive\"]\n\n    # Set the API restriction.\n    # For more information on API key restriction, see:\n    # https:\/\/cloud.google.com\/docs\/authentication\/api-keys\n    restrictions = api_keys_v2.Restrictions()\n    restrictions.ios_key_restrictions = ios_key_restrictions\n\n    key = api_keys_v2.Key()\n    key.name = f\"projects\/{project_id}\/locations\/global\/keys\/{key_id}\"\n    key.restrictions = restrictions\n\n    # Initialize request and set arguments.\n    request = api_keys_v2.UpdateKeyRequest()\n    request.key = key\n    request.update_mask = \"restrictions\"\n\n    # Make the request and wait for the operation to complete.\n    response = client.update_key(request=request).result()\n\n    print(f\"Successfully updated the API key: {response.name}\")\n    # Use response.key_string to authenticate.\n    return response\n```\n\n### REST\n1. Get the ID of the key that you want to restrict.\n   The ID is not the same as the display name or the key string. You can get the ID by using the [keys.list](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/projects.locations.keys\/list) method. The ID is listed in the `uid` field of the response.\n   Replace `PROJECT_ID` with your Google Cloud project ID or name.\n   ```\n   curl -X GET \\\n-H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n\"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/\"\n   ```\n2. Use the [keys.patch](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/projects.locations.keys\/patch) method to specify the iOS apps that can use an API key.\n   This request returns a [long-running operation](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#lro); you must poll the operation to know when the operation completes and get the operation status.\n   Replace the following values:\n   - `ALLOWED_BUNDLE_ID`: The bundle ID of an iOS app that can use the key.\n     You can add the information for as many apps as needed; use commas to separate the bundle IDs. You must provide all bundle IDs with the request; the bundle IDs provided replace any existing allowed applications on the key.\n   - `PROJECT_ID`: Your Google Cloud project ID or name.\n   - `KEY_ID`: The ID of the key that you want to restrict.\n   ```\n   curl -X PATCH \\\n-H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n-H \"Content-Type: application\/json; charset=utf-8\" \\\n--data '{\n\"restrictions\" : {\n\"iosKeyRestrictions\": {\n  \"allowedBundleIds\": [\" ALLOWED_BUNDLE_ID_1 \",\" ALLOWED_BUNDLE_ID_2 \"]\n}\n}\n}' \\\n\"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/ KEY_ID ?updateMask=restrictions\"\n   ```\n\nFor more information about adding iOS app restrictions to a key using the REST API, see [Adding iOS restrictions](https:\/\/docs.cloud.google.com\/api-keys\/docs\/add-restrictions-api-keys#adding_ios_restrictions) in the API Keys API documentation.\n### Add API restrictions\nAPI restrictions specify which APIs can be called using the API key.\n\n**Note:** Before you can specify an API for an API restriction, the API must be enabled for your project. To enable an API, go to the [API dashboard](https:\/\/console.cloud.google.com\/apis\/dashboard).\n\nTo add API restrictions, use one of the following options:\n\n### Console\n1. In the Google Cloud console, go to the **Credentials** page:\n   [Go to Credentials](https:\/\/console.cloud.google.com\/apis\/credentials)\n2. Click the name of the API key that you want to restrict.\n3. In the **API restrictions** section, click **Restrict key**.\n4. Select all APIs that your API key will be used to access.\n5. Click **Save** to save your changes and return to the API key list.\n\n### gcloud\n1. Get the ID of the key that you want to restrict.\n   The ID is not the same as the display name or the key string. You can get the ID by using the [`gcloud services api-keys list` command](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/list) to list the keys in your project.\n2. Use the [`gcloud services api-keys update` command](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/update) to specify which services an API key can be used to access.\n   Replace the following values:\n   - `KEY_ID`: The ID of the key that you want to restrict.\n   - `SERVICE_1`, `SERVICE_2`...: The service names of the APIs that the key can be used to access.\n     You must provide all service names with the update command; the service names provided replace any existing services on the key.\n   You can find the service name by searching for the API on the [API dashboard](https:\/\/console.cloud.google.com\/apis\/dashboard). Service names are strings like `bigquery.googleapis.com`.\n   ```\n   gcloud services api-keys update KEY_ID \\\n--api-target=service=SERVICE_1 --api-target=service=SERVICE_2\n   ```\n\n### Java\nTo run this sample, you must install the [`google-cloud-apikeys` client library](https:\/\/docs.cloud.google.com\/java\/docs\/reference\/google-cloud-apikeys\/latest\/overview).\n```\n\nimport com.google.api.apikeys.v2.ApiKeysClient;\nimport com.google.api.apikeys.v2.ApiTarget;\nimport com.google.api.apikeys.v2.Key;\nimport com.google.api.apikeys.v2.Restrictions;\nimport com.google.api.apikeys.v2.UpdateKeyRequest;\nimport com.google.protobuf.FieldMask;\nimport java.io.IOException;\nimport java.util.concurrent.ExecutionException;\nimport java.util.concurrent.TimeUnit;\nimport java.util.concurrent.TimeoutException;\n\npublic class RestrictApiKeyApi {\n\n  public static void main(String[] args)\n      throws IOException, ExecutionException, InterruptedException, TimeoutException {\n    \/\/ TODO(Developer): Before running this sample,\n    \/\/  1. Replace the variable(s) below.\n    String projectId = \"GOOGLE_CLOUD_PROJECT_ID\";\n\n    \/\/ ID of the key to restrict. This ID is auto-created during key creation.\n    \/\/ This is different from the key string. To obtain the key_id,\n    \/\/ you can also use the lookup api: client.lookupKey()\n    String keyId = \"key_id\";\n\n    restrictApiKeyApi(projectId, keyId);\n  }\n\n  \/\/ Restricts an API key. Restrictions specify which APIs can be called using the API key.\n  public static void restrictApiKeyApi(String projectId, String keyId)\n      throws IOException, ExecutionException, InterruptedException, TimeoutException {\n    \/\/ Initialize client that will be used to send requests. This client only needs to be created\n    \/\/ once, and can be reused for multiple requests. After completing all of your requests, call\n    \/\/ the `apiKeysClient.close()` method on the client to safely\n    \/\/ clean up any remaining background resources.\n    try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) {\n\n      \/\/ Restrict the API key usage by specifying the target service and methods.\n      \/\/ The API key can only be used to authenticate the specified methods in the service.\n      Restrictions restrictions = Restrictions.newBuilder()\n          .addApiTargets(ApiTarget.newBuilder()\n              .setService(\"translate.googleapis.com\")\n              .addMethods(\"translate.googleapis.com.TranslateText\")\n              .build())\n          .build();\n\n      Key key = Key.newBuilder()\n          .setName(String.format(\"projects\/%s\/locations\/global\/keys\/%s\", projectId, keyId))\n          \/\/ Set the restriction(s).\n          \/\/ For more information on API key restriction, see:\n          \/\/ https:\/\/cloud.google.com\/docs\/authentication\/api-keys\n          .setRestrictions(restrictions)\n          .build();\n\n      \/\/ Initialize request and set arguments.\n      UpdateKeyRequest updateKeyRequest = UpdateKeyRequest.newBuilder()\n          .setKey(key)\n          .setUpdateMask(FieldMask.newBuilder().addPaths(\"restrictions\").build())\n          .build();\n\n      \/\/ Make the request and wait for the operation to complete.\n      Key result = apiKeysClient.updateKeyAsync(updateKeyRequest).get(3, TimeUnit.MINUTES);\n\n      \/\/ For authenticating with the API key, use the value in \"result.getKeyString()\".\n      System.out.printf(\"Successfully updated the API key: %s\", result.getName());\n    }\n  }\n}\n```\n\n### Python\nTo run this sample, you must install the [API Keys client library](https:\/\/docs.cloud.google.com\/python\/docs\/reference\/apikeys\/latest).\n```\n\nfrom google.cloud import api_keys_v2\nfrom google.cloud.api_keys_v2 import Key\n\n\ndef restrict_api_key_api(project_id: str, key_id: str) -> Key:\n    \"\"\"\n    Restricts an API key. Restrictions specify which APIs can be called using the API key.\n\n    TODO(Developer): Replace the variables before running the sample.\n\n    Args:\n        project_id: Google Cloud project id.\n        key_id: ID of the key to restrict. This ID is auto-created during key creation.\n            This is different from the key string. To obtain the key_id,\n            you can also use the lookup api: client.lookup_key()\n\n    Returns:\n        response: Returns the updated API Key.\n    \"\"\"\n\n    # Create the API Keys client.\n    client = api_keys_v2.ApiKeysClient()\n\n    # Restrict the API key usage by specifying the target service and methods.\n    # The API key can only be used to authenticate the specified methods in the service.\n    api_target = api_keys_v2.ApiTarget()\n    api_target.service = \"translate.googleapis.com\"\n    api_target.methods = [\"transate.googleapis.com.TranslateText\"]\n\n    # Set the API restriction(s).\n    # For more information on API key restriction, see:\n    # https:\/\/cloud.google.com\/docs\/authentication\/api-keys\n    restrictions = api_keys_v2.Restrictions()\n    restrictions.api_targets = [api_target]\n\n    key = api_keys_v2.Key()\n    key.name = f\"projects\/{project_id}\/locations\/global\/keys\/{key_id}\"\n    key.restrictions = restrictions\n\n    # Initialize request and set arguments.\n    request = api_keys_v2.UpdateKeyRequest()\n    request.key = key\n    request.update_mask = \"restrictions\"\n\n    # Make the request and wait for the operation to complete.\n    response = client.update_key(request=request).result()\n\n    print(f\"Successfully updated the API key: {response.name}\")\n    # Use response.key_string to authenticate.\n    return response\n```\n\n### REST\n1. Get the ID of the key that you want to restrict.\n   The ID is not the same as the display name or the key string. You can get the ID by using the [keys.list](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/projects.locations.keys\/list) method. The ID is listed in the `uid` field of the response.\n   Replace `PROJECT_ID` with your Google Cloud project ID or name.\n   ```\n   curl -X GET \\\n-H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n\"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/\"\n   ```\n2. Use the [keys.patch](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/projects.locations.keys\/patch) method to specify which services an API key can be used to access.\n   This request returns a [long-running operation](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#lro); you must poll the operation to know when the operation completes and get the operation status.\n   Replace the following values:\n   - `SERVICE_1`, `SERVICE_2`...: The service names of the APIs that the key can be used to access.\n     You must provide all service names with the request; the service names provided replace any existing services on the key.\n     You can find the service name by searching for the API on the [API dashboard](https:\/\/console.cloud.google.com\/apis\/dashboard). Service names are strings like `bigquery.googleapis.com`.\n   - `PROJECT_ID`: Your Google Cloud project ID or name.\n   - `KEY_ID`: The ID of the key that you want to restrict.\n   ```\n   curl -X PATCH \\\n-H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n-H \"Content-Type: application\/json; charset=utf-8\" \\\n--data '{\n\"restrictions\" : {\n\"apiTargets\": [\n  {\n    \"service\": \" SERVICE_1 \"\n  },\n  {\n    \"service\" : \" SERVICE_2 \"\n  },\n]\n}\n}' \\\n\"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/ KEY_ID ?updateMask=restrictions\"\n   ```\n\nFor more information about adding API restrictions to a key using the REST API, see [Adding API restrictions](https:\/\/docs.cloud.google.com\/api-keys\/docs\/add-restrictions-api-keys#add-api-restrictions) in the API Keys API documentation.\n## Get project information from a key string\nYou can determine which Google Cloud project an API key is associated with from its string.\n\nReplace `KEY_STRING` with the key string you need project information for.\n\n### gcloud\nYou use the [`gcloud services api-keys lookup` command](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/lookup) to get the project ID from a key string.\n```\n gcloud services api-keys lookup KEY_STRING\n```\n\n### Java\nTo run this sample, you must install the [`google-cloud-apikeys` client library](https:\/\/docs.cloud.google.com\/java\/docs\/reference\/google-cloud-apikeys\/latest\/overview).\n```\n\nimport com.google.api.apikeys.v2.ApiKeysClient;\nimport com.google.api.apikeys.v2.LookupKeyRequest;\nimport com.google.api.apikeys.v2.LookupKeyResponse;\nimport java.io.IOException;\n\npublic class LookupApiKey {\n\n  public static void main(String[] args) throws IOException {\n    \/\/ TODO(Developer): Before running this sample,\n    \/\/  1. Replace the variable(s) below.\n    \/\/  2. Set up ADC as described in https:\/\/cloud.google.com\/docs\/authentication\/external\/set-up-adc\n    \/\/  3. Make sure you have the necessary permission to view API keys.\n    \/\/ API key string to retrieve the API key name.\n    String apiKeyString = \"API_KEY_STRING\";\n\n    lookupApiKey(apiKeyString);\n  }\n\n  \/\/ Retrieves name (full path) of an API key using the API key string.\n  public static void lookupApiKey(String apiKeyString) throws IOException {\n    \/\/ Initialize client that will be used to send requests. This client only needs to be created\n    \/\/ once, and can be reused for multiple requests. After completing all of your requests, call\n    \/\/ the `apiKeysClient.close()` method on the client to safely\n    \/\/ clean up any remaining background resources.\n    try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) {\n\n      \/\/ Initialize the lookup request and set the API key string.\n      LookupKeyRequest lookupKeyRequest = LookupKeyRequest.newBuilder()\n          .setKeyString(apiKeyString)\n          .build();\n\n      \/\/ Make the request and obtain the response.\n      LookupKeyResponse response = apiKeysClient.lookupKey(lookupKeyRequest);\n\n      System.out.printf(\"Successfully retrieved the API key name: %s\", response.getName());\n    }\n  }\n}\n```\n\n### Python\nTo run this sample, you must install the [API Keys client library](https:\/\/docs.cloud.google.com\/python\/docs\/reference\/apikeys\/latest).\n```\n\nfrom google.cloud import api_keys_v2\n\n\ndef lookup_api_key(api_key_string: str) -> None:\n    \"\"\"\n    Retrieves name (full path) of an API key using the API key string.\n\n    TODO(Developer):\n    1. Before running this sample,\n      set up ADC as described in https:\/\/cloud.google.com\/docs\/authentication\/external\/set-up-adc\n    2. Make sure you have the necessary permission to view API keys.\n\n    Args:\n        api_key_string: API key string to retrieve the API key name.\n    \"\"\"\n\n    # Create the API Keys client.\n    client = api_keys_v2.ApiKeysClient()\n\n    # Initialize the lookup request and set the API key string.\n    lookup_key_request = api_keys_v2.LookupKeyRequest(\n        key_string=api_key_string,\n        # Optionally, you can also set the etag (version).\n        # etag=etag,\n    )\n\n    # Make the request and obtain the response.\n    lookup_key_response = client.lookup_key(lookup_key_request)\n\n    print(f\"Successfully retrieved the API key name: {lookup_key_response.name}\")\n```\n\n### REST\nYou use the [`lookupKey` method](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/keys\/lookupKey) to get the project ID from a key string.\n```\ncurl -X GET \\\n-H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n-H \"Content-Type: application\/json; charset=utf-8\" \\\n\"https:\/\/apikeys.googleapis.com\/v2\/keys:lookupKey?keyString= KEY_STRING \"\n```\n## Create a copy of an API key\nIf you need a new API key with the same restrictions as an existing API key, you can create a copy of the existing API key. This operation creates a new API key with a unique key string and ID, with the existing API key's restrictions.\n\nThe copy operation is available only in the Google Cloud console. To use other methods, follow the steps to [create an API key](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#create), and then [apply the same API key restrictions](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#adding-api-restrictions) to the newly generated API key.\n\n1. In the Google Cloud console, go to the **Credentials** page:\n   [Go to Credentials](https:\/\/console.cloud.google.com\/apis\/credentials)\n2. Click the name of the API key that you want to copy.\n   The API key's details page opens.\n3. Click **Create a copy**.\n4. Enter a name for the new API key and confirm that the restrictions are correct.\n5. Click **Create**.\n## Rotate an API key\nBy periodically rotating your API keys, you can limit the impact of any compromised API keys.\n\nWhen you rotate an API key, you create a new key with the same restrictions as the old key, and update your applications to use the new key. After all of your applications are updated, you delete the old key.\n\nThe rotation operation is available only in the Google Cloud console. To use other methods, follow the steps to [create an API key](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#create), and then [apply the same API key restrictions](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#adding-api-restrictions) to the newly generated API key. After updating your applications to use the new key, you delete the old key.\n\n1. In the Google Cloud console, go to the **Credentials** page:\n   [Go to Credentials](https:\/\/console.cloud.google.com\/apis\/credentials)\n2. Click the name of the API key that you want to rotate to open its details page.\n3. Click **Rotate key**.\n4. Enter a name for the new API key and confirm that the restrictions are correct.\n5. Click **Create**.\n6. Copy the key string and update your applications to use the new string.\n7. After you have updated all applications to use the new key, return to the details page for the new key. In the **Previous key** section, click **Delete the previous key** to delete the old key.\n   If you find that you deleted the old key prematurely, you can [undelete it](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#undelete).\n## Undelete an API key\nIf you delete an API key by mistake, you can undelete (restore) that key within 30 days of deleting the key. After 30 days, you cannot undelete the API key.\n\n### Console\n1. In the Google Cloud console, go to the **Credentials** page:\n   [Go to Credentials](https:\/\/console.cloud.google.com\/apis\/credentials)\n2. Click **Restore deleted credentials**.\n3. Find the deleted API key that you want to undelete, and click **Restore**.\n   Undeleting an API key may take a few minutes to propagate. After propagation, the undeleted API key is displayed in the API keys list.\n\n### gcloud\n1. Get the ID of the key that you want to undelete.\n   The ID is not the same as the display name or the key string. You can get the ID by using the [`gcloud services api-keys list --show-deleted` command](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/list) to list the deleted keys in your project.\n2. Use the [`gcloud services api-keys undelete` command](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/undelete) to undelete an API key.\n   ```\n   gcloud services api-keys undelete KEY_ID\n   ```\n   Replace the following values:\n   - `KEY_ID`: The ID of the key that you want to undelete.\n\n### Java\nTo run this sample, you must install the [`google-cloud-apikeys` client library](https:\/\/docs.cloud.google.com\/java\/docs\/reference\/google-cloud-apikeys\/latest\/overview).\n```\nimport com.google.api.apikeys.v2.ApiKeysClient;\nimport com.google.api.apikeys.v2.Key;\nimport com.google.api.apikeys.v2.UndeleteKeyRequest;\nimport java.io.IOException;\nimport java.util.concurrent.ExecutionException;\nimport java.util.concurrent.TimeUnit;\nimport java.util.concurrent.TimeoutException;\n\npublic class UndeleteApiKey {\n\n  public static void main(String[] args)\n      throws IOException, ExecutionException, InterruptedException, TimeoutException {\n    \/\/ TODO(developer): Replace these variables before running the sample.\n    \/\/ Project ID or project number of the Google Cloud project.\n    String projectId = \"YOUR_PROJECT_ID\";\n    \/\/ The API key id to undelete.\n    String keyId = \"YOUR_KEY_ID\";\n\n    undeleteApiKey(projectId, keyId);\n  }\n\n  \/\/ Undeletes an API key.\n  public static void undeleteApiKey(String projectId, String keyId)\n      throws IOException, ExecutionException, InterruptedException, TimeoutException {\n    \/\/ Initialize client that will be used to send requests. This client only needs to be created\n    \/\/ once, and can be reused for multiple requests.\n    try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) {\n\n      \/\/ Initialize the undelete request and set the argument.\n      UndeleteKeyRequest undeleteKeyRequest = UndeleteKeyRequest.newBuilder()\n          .setName(String.format(\"projects\/%s\/locations\/global\/keys\/%s\", projectId, keyId))\n          .build();\n\n      \/\/ Make the request and wait for the operation to complete.\n      Key undeletedKey = apiKeysClient.undeleteKeyAsync(undeleteKeyRequest)\n          .get(3, TimeUnit.MINUTES);\n\n      System.out.printf(\"Successfully undeleted the API key: %s\", undeletedKey.getName());\n    }\n  }\n}\n```\n\n### REST\n1. Get the ID of the key that you want to undelete.\n   The ID is not the same as the display name or the key string. You can get the ID by using the [keys.list](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/projects.locations.keys\/list) method, with the `showDeleted` query parameter set to `true`. The key ID is listed in the `uid` field of the response.\n   Replace `PROJECT_ID` with your Google Cloud project ID or name.\n   ```\n   curl -X GET \\\n-H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n\"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys?showDeleted=true\"\n   ```\n2. Use the [undelete](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/projects.locations.keys\/undelete) method to undelete the API key.\n   ```\n   curl -X POST \\\n-H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n-H \"Content-Type: application\/json; charset=utf-8\" \\\n\"https:\/\/apikeys.googleapis.com\/v2\/projects\/ PROJECT_ID \/locations\/global\/keys\/ KEY_ID :undelete\"\n   ```\n   This request returns a [long-running operation](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#lro); you must poll the operation to know when the operation completes and get the operation status.\n   Replace the following values:\n   - `PROJECT_ID`: Your Google Cloud project ID or name.\n   - `KEY_ID`: The ID of the key that you want to restrict.\n## Determine the API key type\nYou can determine whether the API key is bound to a service account by inspecting the key.\n\n### Console\n1. In the Google Cloud console, go to the **Credentials** page:\n   [Go to Credentials](https:\/\/console.cloud.google.com\/apis\/credentials)\n   If the API key is bound to a service account, the service account identifier is displayed.\n\n### gcloud\n1. Get the ID of the key.\n   The ID is not the same as the display name or the key string. You can get the ID by using the [`gcloud services api-keys list` command](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/list) to list the keys in your project.\n2. Use the [`gcloud services api-keys describe` command](https:\/\/docs.cloud.google.com\/sdk\/gcloud\/reference\/services\/api-keys\/describe) to describe the API key.\n   ```\n   gcloud services api-keys describe KEY_ID\n   ```\n   If the API key is bound to a service account, the `serviceAccountEmail` field is displayed.\n## Poll long-running operations\nAPI Keys API methods use long-running operations. If you use the REST API to create and manage API keys, an operation object is returned from the initial method request. You use the operation name to poll the long-running operation. When the long-running request completes, polling the operation returns the data from the long-running request.\n\nTo poll a long-running API Keys API operation, you use the [`operations.get`](https:\/\/docs.cloud.google.com\/api-keys\/docs\/reference\/rest\/v2\/operations\/get) method.\n\nReplace `OPERATION_NAME` with the operation name returned by the long-running operation. For example, `operations\/akmf.p7-358517206116-cd10a88a-7740-4403-a8fd-979f3bd7fe1c`.\n```\ncurl -X GET \\\n    -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n    -H \"Content-Type: application\/json; charset=utf-8\" \\\n    \"https:\/\/apikeys.googleapis.com\/v2\/ OPERATION_NAME \"\n```\n## Limits on API keys\nYou can create up to 300 API keys per project. This limit is a system limit, and can't be changed using a quota increase request. If more API keys are needed, you must use more than one project.\n\nYou can add up to 1200 [application restrictions](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys#adding-application-restrictions) to an API key.\n\n## What's next\n- Learn about [best practices for keeping your API keys secure](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys-best-practices).\n- Learn more about the [API Keys API](https:\/\/docs.cloud.google.com\/api-keys\/docs\/overview).\n\nSend feedback\n\nExcept as otherwise noted, the content of this page is licensed under the [Creative Commons Attribution 4.0 License](https:\/\/creativecommons.org\/licenses\/by\/4.0\/), and code samples are licensed under the [Apache 2.0 License](https:\/\/www.apache.org\/licenses\/LICENSE-2.0). For details, see the [Google Developers Site Policies](https:\/\/developers.google.com\/site-policies). Java is a registered trademark of Oracle and\/or its affiliates.\n\nLast updated 2025-10-16 UTC.\n\nNeed to tell us more?\n\n\\[\\[\\[\"Easy to understand\",\"easyToUnderstand\",\"thumb-up\"\\],\\[\"Solved my problem\",\"solvedMyProblem\",\"thumb-up\"\\],\\[\"Other\",\"otherUp\",\"thumb-up\"\\]\\],\\[\\[\"Hard to understand\",\"hardToUnderstand\",\"thumb-down\"\\],\\[\"Incorrect information or sample code\",\"incorrectInformationOrSampleCode\",\"thumb-down\"\\],\\[\"Missing the information\/samples I need\",\"missingTheInformationSamplesINeed\",\"thumb-down\"\\],\\[\"Other\",\"otherDown\",\"thumb-down\"\\]\\],\\[\"Last updated 2025-10-16 UTC.\"\\],\\[\\],\\[\\]\\]\n\n- ### Products and pricing\n  - [See all products](https:\/\/cloud.google.com\/products\/)\n  - [Google Cloud pricing](https:\/\/cloud.google.com\/pricing\/)\n  - [Google Cloud Marketplace](https:\/\/cloud.google.com\/marketplace\/)\n  - [Contact sales](https:\/\/cloud.google.com\/contact\/)\n- ### Support\n  - [Google Cloud Community](https:\/\/www.googlecloudcommunity.com\/)\n  - [Support](https:\/\/cloud.google.com\/support-hub\/)\n  - [Release Notes](https:\/\/cloud.google.com\/release-notes)\n  - [System status](https:\/\/status.cloud.google.com\/)\n- ### Resources\n  - [GitHub](https:\/\/github.com\/googlecloudPlatform\/)\n  - [Getting Started with Google Cloud](https:\/\/docs.cloud.google.com\/docs\/get-started\/)\n  - [Code samples](https:\/\/docs.cloud.google.com\/docs\/samples)\n  - [Cloud Architecture Center](https:\/\/docs.cloud.google.com\/architecture\/)\n  - [Training and Certification](https:\/\/cloud.google.com\/learn\/training\/)\n- ### Engage\n  - [Blog](https:\/\/cloud.google.com\/blog\/)\n  - [Events](https:\/\/cloud.google.com\/events\/)\n  - [X (Twitter)](https:\/\/x.com\/googlecloud)\n  - [Google Cloud on YouTube](https:\/\/www.youtube.com\/googlecloud)\n  - [Google Cloud Tech on YouTube](https:\/\/www.youtube.com\/googlecloudplatform)\n\n- [About Google](https:\/\/about.google\/)\n- [Privacy](https:\/\/policies.google.com\/privacy)\n- [Site terms](https:\/\/policies.google.com\/terms?hl=en)\n- [Google Cloud terms](https:\/\/docs.cloud.google.com\/product-terms\/)\n- [Manage cookies](https:\/\/docs.cloud.google.com\/docs\/authentication\/api-keys)\n- [Our third decade of climate action: join us](https:\/\/cloud.google.com\/sustainability)\n- Sign up for the Google Cloud newsletter  [Subscribe](https:\/\/cloud.google.com\/newsletter\/)\n\n- [English]()\n- [Deutsch]()\n- [Español]()\n- [Español – América Latina]()\n- [Français]()\n- [Indonesia]()\n- [Italiano]()\n- [Português]()\n- [Português – Brasil]()\n- [中文 – 简体]()\n- [中文 – 繁體]()\n- [日本語]()\n- [한국어]()","attrs_readable_markdown":null,"meta_canonical":null}

3. Robots.txt Check

Query:

Response:

4. Spam/Ban Check

Query:

Response:

5. Seen Status Check

ℹ️ Skipped - page is already crawled

📄

INDEXABLE

✅

CRAWLED

5 months ago

🤖

ROBOTS ALLOWED

Page Info Filters

Filter	Status	Condition	Details
HTTP status	PASS	`download_http_code = 200`	HTTP 200
Age cutoff	PASS	`download_stamp > now() - 6 MONTH`	5.7 months ago (distributed domain, exempt)
History drop	PASS	`isNull(history_drop_reason)`	No drop reason
Spam/ban	PASS	`fh_dont_index != 1 AND ml_spam_score = 0`	ml_spam_score=0
Canonical	PASS	`meta_canonical IS NULL OR = '' OR = src_unparsed`	Not set

Page Details

Property	Value
URL	https://docs.cloud.google.com/docs/authentication/api-keys
Last Crawled	2025-10-22 18:18:57 (5 months ago)
First Indexed	not set
HTTP Status Code	200
Meta Title	Manage API keys \| Authentication \| Google Cloud Documentation
Meta Description	null
Meta Canonical	null
Boilerpipe Text	This page describes how to create, edit, and restrict API keys. For information about how to use API keys to access Google APIs, see Use API keys to access APIs . Introduction to API keys There are two types of API keys: standard API keys, and API keys that have been bound to a service account. Standard API keys Standard API keys provide a way to associate a request with a project for billing and quota purposes. When you use a standard API key (an API key that has not been bound to a service account) to access an API, the API key doesn't identify a principal . Without a principal, the request can't use Identity and Access Management (IAM) to check whether the caller is authorized to perform the requested operation. Standard API keys can be used with any API that accepts API keys, unless API restrictions have been added to the key. Standard API keys can't be used with services that don't accept API keys, including in express mode . API keys bound to a service account API keys bound to a service account provide the identity and authorization of the service account to a request. When you use an API key that has been bound to a service account to access an API, your request is processed as if you used the bound service account to make the request. The only API that supports bound API keys is aiplatform.googleapis.com . Binding keys to a service account is prevented by a default organization policy constraint. To change this, see Enable key binding to service accounts . API key components An API key has the following components, which let you manage and use the key: String The API key string is an encrypted string, for example, AIzaSyDaGmWKa4JsXZ-HjGw7ISLn_3namBGewQe . When you use an API key to access an API, you always use the key's string. API keys don't have an associated JSON file. ID The API key ID is used by Google Cloud administrative tools to uniquely identify the key. The key ID can't be used to access APIs. The key ID can be found in the URL of the key's edit page in the Google Cloud console. You can also get the key ID by using the Google Cloud CLI to list the keys in your project. Display name The display name is an optional, descriptive name for the key, which you can set when you create or update the key. Bound service account API keys that are bound to a service account include the service account's email address. Before you begin Complete the following tasks to use the samples on this page. Set up authentication Select the tab for how you plan to use the samples on this page: Console When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication. gcloud In the Google Cloud console, activate Cloud Shell. Activate Cloud Shell At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize. C++ To use the C++ samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials. Install the Google Cloud CLI. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity . If you're using a local shell, then create local authentication credentials for your user account: gcloud auth application-default login You don't need to do this if you're using Cloud Shell. If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity . For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation. Java To use the Java samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials. Install the Google Cloud CLI. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity . If you're using a local shell, then create local authentication credentials for your user account: gcloud auth application-default login You don't need to do this if you're using Cloud Shell. If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity . For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation. Python To use the Python samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials. Install the Google Cloud CLI. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity . If you're using a local shell, then create local authentication credentials for your user account: gcloud auth application-default login You don't need to do this if you're using Cloud Shell. If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have signed in to the gcloud CLI with your federated identity . For more information, see Set up ADC for a local development environment in the Google Cloud authentication documentation. REST To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI. Install the Google Cloud CLI. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity . For more information, see Authenticate for using REST in the Google Cloud authentication documentation. Required roles To get the permissions that you need to manage API keys, ask your administrator to grant you the following IAM roles on your project: API Keys Admin ( roles/serviceusage.apiKeysAdmin ) Restrict an API key to specific APIs by using the Google Cloud console: Service Usage Viewer ( roles/serviceusage.serviceUsageViewer ) For more information about granting roles, see Manage access to projects, folders, and organizations . You might also be able to get the required permissions through custom roles or other predefined roles . Enable key binding to service accounts Before you can bind an API key to a service account , you first need to set the constraints/iam.managed.disableServiceAccountApiKeyCreation organization policy constraint to false . Changing the organization policy requires an associated organization resource . Projects without an organization aren't supported. To change the policy constraint, complete the following instructions. Console In the Google Cloud console, go to the Organization policies page. Go to Organization policies Switch to the organization, folder, or project you want to change the policies for. In the Filter box, enter Block service , and then click the filter name Block service account API key bindings . Click Manage policy . In the Policy source section, select Override parent's policy . Click Add a rule , and set Enforcement to Off . Click Done . Optional: Click Test changes to give you insight on how the proposed policy might cause compliance violations or disruptions. Click Set policy . gcloud Create a file named spec.yaml , with the following content: name : SCOPE / SCOPE_ID /policies/iam.managed.disableServiceAccountApiKeyCreation spec : rules : - enforce : false Provide the following values: SCOPE : Either organizations , folders , or projects . SCOPE_ID : Depending on SCOPE , the ID of the organization, folder, or project to which the organization policy applies. Run the following gcloud command to allow binding of API keys to service accounts: gcloud org-policies set-policy spec.yaml \ --update-mask spec Create an API key To create an API key, use one of the following options: Console In the Google Cloud console, go to the Credentials page: Go to Credentials Click Create credentials , and then select API key from the menu. Optional: To bind the API key to a service account, select the Authenticate API calls through a service account checkbox and then click Select a service account to select the service account you want to bind to the key. For more information, see API keys bound to a service account . Add API key restrictions. Restricting API keys is a best practice. For more information, see Apply API key restrictions . Click Create . The API key created dialog displays the string for your newly created key. gcloud You use the gcloud services api-keys create command to create an API key. Replace DISPLAY_NAME with a descriptive name for your key. gcloud services api-keys create \ --display-name = DISPLAY_NAME Optional: To bind the API key to a service account, use gcloud beta instead, with the --service-account flag: gcloud beta services api-keys create \ --display-name = DISPLAY_NAME \ --service-account = SERVICE_ACCOUNT_EMAIL_ADDRESS For more information, see API keys bound to a service account . C++ To run this sample, you must install the API Keys client library . Java To run this sample, you must install the google-cloud-apikeys client library . Python To run this sample, you must install the API Keys client library . REST You use the keys.create method to create an API key. This request returns a long-running operation ; you must poll the operation to get the information for the new key. Replace the following values: DISPLAY_NAME : Optional. A descriptive name for your key. PROJECT_ID : Your Google Cloud project ID or name. curl - X POST \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ - H "Content-Type: application/json; charset=utf-8" \ - d { ' "displayName" : " DISPLAY_NAME " ' } \ "https://apikeys.googleapis.com/v2/projects/ PROJECT /locations/global/keys" Optional: To bind the API key to a service account instead, use the following command: curl - X POST \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ - H "Content-Type: application/json; charset=utf-8" \ - d { ' "displayName" : " DISPLAY_NAME " , "serviceAccountEmail" : " SERVICE_ACCOUNT_EMAIL " ' } \ "https://apikeys.googleapis.com/v2/projects/ PROJECT /locations/global/keys" For more information, see API keys bound to a service account . For more information about creating API keys using the REST API, see Creating an API key in the API Keys API documentation. Apply API key restrictions API keys are unrestricted by default. Unrestricted keys are insecure because they can be used by anyone from anywhere. For production applications, you should set both application restrictions and API restrictions . Add application restrictions Application restrictions specify which websites, IP addresses, or apps can use an API key. You can apply only one application restriction type at a time. Choose the restriction type based on your application type: Option Application type Notes HTTP referrers Web applications Specifies the websites that can use the key. IP Addresses Applications called by specific servers Specifies the servers or cron jobs that can use the key. This is the only restriction available if you bind your API key to a service account. Android apps Android applications Specifies the Android application that can use the key. iOS apps iOS applications Specifies the iOS bundles that can use the key. HTTP referrers To restrict the websites that can use your API key, you add one or more HTTP referrer restrictions. You can substitute a wildcard character ( * ) for the subdomain or the path, but you can't insert a wildcard character into the middle of the URL. For example, .example.com is valid, and accepts all sites ending in .example.com . However, mysubdomain.example.com is not a valid restriction. Port numbers can be included in HTTP referrer restrictions. If you include a port number, then only requests using that port are matched. If you don't specify a port number, then requests from any port number are matched. The following table shows some example scenarios and browser restrictions: Scenario Restrictions Allow a specific URL Add a URL with an exact path. For example: www.example.com/path www.example.com/path/path Some browsers implement a referrer policy that sends only the origin URL for cross-origin requests. Users of these browsers can't use keys with page-specific URL restrictions. Allow any URL in your site You must set two URLs in the allowedReferers list. URL for the domain, without a subdomain, and with a wildcard for the path. For example: example.com/* A second URL that includes a wildcard for the subdomain and a wildcard for the path. For example: .example.com/ Allow any URL in a single subdomain or naked domain You must set two URLs in the allowedReferers list to allow an entire domain: URL for the domain, without a trailing slash. For example: www.example.com sub.example.com example.com A second URL for the domain that includes a wildcard for the path. For example: www.example.com/* sub.example.com/* example.com/* To restrict your API key to specific websites, use one of the following options: Console In the Google Cloud console, go to the Credentials page: Go to Credentials Click the name of the API key that you want to restrict. In the Application restrictions section, select HTTP referrers . For each restriction that you want to add, click Add an item , enter the restriction, and click Done . Click Save to save your changes and return to the API key list. gcloud Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the gcloud services api-keys list command to list the keys in your project. Use the gcloud services api-keys update command to add HTTP referrer restrictions to an API key. Replace the following values: KEY_ID : The ID of the key that you want to restrict. ALLOWED_REFERRER_1 : Your HTTP referrer restriction. You can add as many restrictions as needed; use commas to separate the restrictions. You must provide all referrer restrictions with the update command; the referrer restrictions provided replace any existing referrer restrictions on the key. gcloud services api-keys update KEY_ID \ --allowed-referrers = " ALLOWED_REFERRER_1 " Java To run this sample, you must install the google-cloud-apikeys client library . Python To run this sample, you must install the API Keys client library . REST Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the keys.list method. The ID is listed in the uid field of the response. Replace PROJECT_ID with your Google Cloud project ID or name. curl - X GET \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/" Use the keys.patch method to add HTTP referrer restrictions to the API key. This request returns a long-running operation ; you must poll the operation to know when the operation completes and get the operation status. Replace the following values: ALLOWED_REFERRER_1 : Your HTTP referrer restriction. You can add as many restrictions as needed; use commas to separate the restrictions. You must provide all referrer restrictions with the request; the referrer restrictions provided replace any existing referrer restrictions on the key. PROJECT_ID : Your Google Cloud project ID or name. KEY_ID : The ID of the key that you want to restrict. curl - X PATCH \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ - H "Content-Type: application/json; charset=utf-8" \ -- da ta ' { "restrictions" : { "browserKeyRestrictions" : { "allowedReferrers" : [ " ALLOWED_REFERRER_1 " ] } } } ' \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/ KEY_ID ?updateMask=restrictions" For more information about adding HTTP referrer restrictions to a key using the REST API, see Adding browser restrictions in the API Keys API documentation. IP Addresses You can specify one or more IP addresses of the callers, such as a web server or cron job, that are allowed to use your API key. You can specify the IP addresses in any of the following formats: IPv4 ( 198.51.100.1 ) IPv6 ( 2001:db8::1 ) A subnet using CIDR notation ( 198.51.100.0/24 , 2001:db8::/64 ) Using localhost is not supported for server restrictions. To restrict your API key to specific IP addresses, use one of the following options: Console In the Google Cloud console, go to the Credentials page: Go to Credentials Click the name of the API key that you want to restrict. In the Application restrictions section, select IP addresses . For each IP address that you want to add, click Add an item , enter the address, and click Done . Click Save to save your changes and return to the API key list. gcloud Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the gcloud services api-keys list command to list the keys in your project. Use the gcloud services api-keys update command to add server (IP address) restrictions to an API key. Replace the following values: KEY_ID : The ID of the key that you want to restrict. ALLOWED_IP_ADDR_1 : Your allowed IP address. You can add as many IP addresses as needed; use commas to separate the addresses. gcloud services api-keys update KEY_ID \ --allowed-ips = " ALLOWED_IP_ADDR_1 " Java To run this sample, you must install the google-cloud-apikeys client library . Python To run this sample, you must install the API Keys client library . REST Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the keys.list method. The ID is listed in the uid field of the response. Replace PROJECT_ID with your Google Cloud project ID or name. curl - X GET \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/" Use the keys.patch method to add server (IP address) restrictions to an API key. This request returns a long-running operation ; you must poll the operation to know when the operation completes and get the operation status. Replace the following values: ALLOWED_IP_ADDR_1 : Your allowed IP address. You can add as many IP addresses as needed; use commas to separate the restrictions. You must provide all IP addresses with the request; the referrer restrictions provided replace any existing IP address restrictions on the key. PROJECT_ID : Your Google Cloud project ID or name. KEY_ID : The ID of the key that you want to restrict. curl - X PATCH \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ - H "Content-Type: application/json; charset=utf-8" \ -- da ta ' { "restrictions" : { "serverKeyRestrictions" : { "allowedIps" : [ " ALLOWED_IP_ADDR_1 " ] } } } ' \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/ KEY_ID ?updateMask=restrictions" For more information about adding IP address restrictions to a key using the REST API, see Adding server restrictions in the API Keys API documentation. Android apps You can restrict usage of an API key to specific Android apps. You must provide the package name and the 20-byte SHA-1 certificate fingerprint for each app. When you use the API key in a request, you must specify the package name and certificate fingerprint by using the following HTTP headers: X-Android-Package X-Android-Cert To restrict your API key to one or more Android apps, use one of the following options: Console In the Google Cloud console, go to the Credentials page: Go to Credentials Click the name of the API key that you want to restrict. In the Application restrictions section, select Android apps . For each Android app that you want to add, click Add an item and enter the package name and SHA-1 certificate fingerprint, then click Done . Click Save to save your changes and return to the API key list. gcloud Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the gcloud services api-keys list command to list the keys in your project. Use the gcloud services api-keys update command to specify the Android apps that can use an API key. Replace the following values: KEY_ID : The ID of the key that you want to restrict. SHA1_FINGERPRINT and PACKAGE_NAME : The app information for an Android app that can use the key. You can add as many apps as needed; use additional --allowed-application flags. gcloud services api-keys update KEY_ID \ --allowed-application = sha1_fingerprint = SHA1_FINGERPRINT_1 ,package_name = PACKAGE_NAME_1 \ --allowed-application = sha1_fingerprint = SHA1_FINGERPRINT_2 ,package_name = PACKAGE_NAME_2 Java To run this sample, you must install the google-cloud-apikeys client library . Python To run this sample, you must install the API Keys client library . REST Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the keys.list method. The ID is listed in the uid field of the response. Replace PROJECT_ID with your Google Cloud project ID or name. curl - X GET \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/" Use the keys.patch method to specify the Android apps that can use an API key. This request returns a long-running operation ; you must poll the operation to know when the operation completes and get the operation status. Replace the following values: SHA1_FINGERPRINT_1 and PACKAGE_NAME_1 : The app information for an Android app that can use the key. You can add the information for as many apps as needed; use commas to separate the AndroidApplication objects. You must provide all applications with the request; the applications provided replace any existing allowed applications on the key. PROJECT_ID : Your Google Cloud project ID or name. KEY_ID : The ID of the key that you want to restrict. curl - X PATCH \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ - H "Content-Type: application/json; charset=utf-8" \ -- da ta ' { "restrictions" : { "androidKeyRestrictions" : { "allowedApplications" : [ { "sha1Fingerprint" : " SHA1_FINGERPRINT_1 " , "packageName" : " PACKAGE_NAME_1 " }, ] } } } ' \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/ KEY_ID ?updateMask=restrictions" For more information about adding Android app restrictions to a key using the REST API, see Adding Android restrictions in the API Keys API documentation. iOS apps You can restrict usage of an API key to specific iOS apps by providing the bundle ID of each app. When you use the API key in a request, you must specify the bundle ID by using the X-Ios-Bundle-Identifier HTTP header. To restrict your API key to one or more iOS apps, use one of the following options: Console In the Google Cloud console, go to the Credentials page: Go to Credentials Click the name of the API key that you want to restrict. In the Application restrictions section, select iOS apps . For each iOS app that you want to add, click Add an item and enter the bundle ID, then click Done . Click Save to save your changes and return to the API key list. gcloud Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the gcloud services api-keys list command to list the keys in your project. Use the gcloud services api-keys update method to specify the iOS apps that can use the key. Replace the following values: KEY_ID : The ID of the key that you want to restrict. ALLOWED_BUNDLE_ID : The bundle ID of an iOS app that you want to be able to use this API key. You can add as many bundle IDs as needed; use commas to separate the IDs. gcloud services api-keys update KEY_ID \ --allowed-bundle-ids = ALLOWED_BUNDLE_ID_1 , ALLOWED_BUNDLE_ID_2 Java To run this sample, you must install the google-cloud-apikeys client library . Python To run this sample, you must install the API Keys client library . REST Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the keys.list method. The ID is listed in the uid field of the response. Replace PROJECT_ID with your Google Cloud project ID or name. curl - X GET \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/" Use the keys.patch method to specify the iOS apps that can use an API key. This request returns a long-running operation ; you must poll the operation to know when the operation completes and get the operation status. Replace the following values: ALLOWED_BUNDLE_ID : The bundle ID of an iOS app that can use the key. You can add the information for as many apps as needed; use commas to separate the bundle IDs. You must provide all bundle IDs with the request; the bundle IDs provided replace any existing allowed applications on the key. PROJECT_ID : Your Google Cloud project ID or name. KEY_ID : The ID of the key that you want to restrict. curl - X PATCH \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ - H "Content-Type: application/json; charset=utf-8" \ -- da ta ' { "restrictions" : { "iosKeyRestrictions" : { "allowedBundleIds" : [ " ALLOWED_BUNDLE_ID_1 " , " ALLOWED_BUNDLE_ID_2 " ] } } } ' \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/ KEY_ID ?updateMask=restrictions" For more information about adding iOS app restrictions to a key using the REST API, see Adding iOS restrictions in the API Keys API documentation. Add API restrictions API restrictions specify which APIs can be called using the API key. To add API restrictions, use one of the following options: Console In the Google Cloud console, go to the Credentials page: Go to Credentials Click the name of the API key that you want to restrict. In the API restrictions section, click Restrict key . Select all APIs that your API key will be used to access. Click Save to save your changes and return to the API key list. gcloud Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the gcloud services api-keys list command to list the keys in your project. Use the gcloud services api-keys update command to specify which services an API key can be used to access. Replace the following values: KEY_ID : The ID of the key that you want to restrict. SERVICE_1 , SERVICE_2 ...: The service names of the APIs that the key can be used to access. You must provide all service names with the update command; the service names provided replace any existing services on the key. You can find the service name by searching for the API on the API dashboard . Service names are strings like bigquery.googleapis.com . gcloud services api-keys update KEY_ID \ --api-target = service = SERVICE_1 --api-target = service = SERVICE_2 Java To run this sample, you must install the google-cloud-apikeys client library . Python To run this sample, you must install the API Keys client library . REST Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the keys.list method. The ID is listed in the uid field of the response. Replace PROJECT_ID with your Google Cloud project ID or name. curl - X GET \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/" Use the keys.patch method to specify which services an API key can be used to access. This request returns a long-running operation ; you must poll the operation to know when the operation completes and get the operation status. Replace the following values: SERVICE_1 , SERVICE_2 ...: The service names of the APIs that the key can be used to access. You must provide all service names with the request; the service names provided replace any existing services on the key. You can find the service name by searching for the API on the API dashboard . Service names are strings like bigquery.googleapis.com . PROJECT_ID : Your Google Cloud project ID or name. KEY_ID : The ID of the key that you want to restrict. curl - X PATCH \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ - H "Content-Type: application/json; charset=utf-8" \ -- da ta ' { "restrictions" : { "apiTargets" : [ { "service" : " SERVICE_1 " }, { "service" : " SERVICE_2 " }, ] } } ' \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/ KEY_ID ?updateMask=restrictions" For more information about adding API restrictions to a key using the REST API, see Adding API restrictions in the API Keys API documentation. Get project information from a key string You can determine which Google Cloud project an API key is associated with from its string. Replace KEY_STRING with the key string you need project information for. gcloud You use the gcloud services api-keys lookup command to get the project ID from a key string. gcloud services api-keys lookup KEY_STRING Java To run this sample, you must install the google-cloud-apikeys client library . Python To run this sample, you must install the API Keys client library . REST You use the lookupKey method to get the project ID from a key string. curl - X GET \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ - H "Content-Type: application/json; charset=utf-8" \ "https://apikeys.googleapis.com/v2/keys:lookupKey?keyString= KEY_STRING " Create a copy of an API key If you need a new API key with the same restrictions as an existing API key, you can create a copy of the existing API key. This operation creates a new API key with a unique key string and ID, with the existing API key's restrictions. The copy operation is available only in the Google Cloud console. To use other methods, follow the steps to create an API key , and then apply the same API key restrictions to the newly generated API key. In the Google Cloud console, go to the Credentials page: Go to Credentials Click the name of the API key that you want to copy. The API key's details page opens. Click Create a copy . Enter a name for the new API key and confirm that the restrictions are correct. Click Create . Rotate an API key By periodically rotating your API keys, you can limit the impact of any compromised API keys. When you rotate an API key, you create a new key with the same restrictions as the old key, and update your applications to use the new key. After all of your applications are updated, you delete the old key. The rotation operation is available only in the Google Cloud console. To use other methods, follow the steps to create an API key , and then apply the same API key restrictions to the newly generated API key. After updating your applications to use the new key, you delete the old key. In the Google Cloud console, go to the Credentials page: Go to Credentials Click the name of the API key that you want to rotate to open its details page. Click Rotate key . Enter a name for the new API key and confirm that the restrictions are correct. Click Create . Copy the key string and update your applications to use the new string. After you have updated all applications to use the new key, return to the details page for the new key. In the Previous key section, click Delete the previous key to delete the old key. If you find that you deleted the old key prematurely, you can undelete it . Undelete an API key If you delete an API key by mistake, you can undelete (restore) that key within 30 days of deleting the key. After 30 days, you cannot undelete the API key. Console In the Google Cloud console, go to the Credentials page: Go to Credentials Click Restore deleted credentials . Find the deleted API key that you want to undelete, and click Restore . Undeleting an API key may take a few minutes to propagate. After propagation, the undeleted API key is displayed in the API keys list. gcloud Get the ID of the key that you want to undelete. The ID is not the same as the display name or the key string. You can get the ID by using the gcloud services api-keys list --show-deleted command to list the deleted keys in your project. Use the gcloud services api-keys undelete command to undelete an API key. gcloud services api-keys undelete KEY_ID Replace the following values: KEY_ID : The ID of the key that you want to undelete. Java To run this sample, you must install the google-cloud-apikeys client library . REST Get the ID of the key that you want to undelete. The ID is not the same as the display name or the key string. You can get the ID by using the keys.list method, with the showDeleted query parameter set to true . The key ID is listed in the uid field of the response. Replace PROJECT_ID with your Google Cloud project ID or name. curl - X GET \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys?showDeleted=true" Use the undelete method to undelete the API key. curl - X POST \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ - H "Content-Type: application/json; charset=utf-8" \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/ KEY_ID :undelete" This request returns a long-running operation ; you must poll the operation to know when the operation completes and get the operation status. Replace the following values: PROJECT_ID : Your Google Cloud project ID or name. KEY_ID : The ID of the key that you want to restrict. Determine the API key type You can determine whether the API key is bound to a service account by inspecting the key. Console In the Google Cloud console, go to the Credentials page: Go to Credentials If the API key is bound to a service account, the service account identifier is displayed. gcloud Get the ID of the key. The ID is not the same as the display name or the key string. You can get the ID by using the gcloud services api-keys list command to list the keys in your project. Use the gcloud services api-keys describe command to describe the API key. gcloud services api-keys describe KEY_ID If the API key is bound to a service account, the serviceAccountEmail field is displayed. Poll long-running operations API Keys API methods use long-running operations. If you use the REST API to create and manage API keys, an operation object is returned from the initial method request. You use the operation name to poll the long-running operation. When the long-running request completes, polling the operation returns the data from the long-running request. To poll a long-running API Keys API operation, you use the operations.get method. Replace OPERATION_NAME with the operation name returned by the long-running operation. For example, operations/akmf.p7-358517206116-cd10a88a-7740-4403-a8fd-979f3bd7fe1c . curl - X GET \ - H "Authorization: Bearer $(gcloud auth print-access-token)" \ - H "Content-Type: application/json; charset=utf-8" \ "https://apikeys.googleapis.com/v2/ OPERATION_NAME " Limits on API keys You can create up to 300 API keys per project. This limit is a system limit, and can't be changed using a quota increase request. If more API keys are needed, you must use more than one project. You can add up to 1200 application restrictions to an API key. What's next
Markdown	[Skip to main content](https://docs.cloud.google.com/docs/authentication/api-keys#main-content) [![Google Cloud Documentation](https://www.gstatic.com/devrel-devsite/prod/v59c691115ec6a53e3bf17af135bec44a3bb95c23eb778b8c9e469e221a6634ea/clouddocs/images/lockup.svg)](https://docs.cloud.google.com/) [Documentation](https://docs.cloud.google.com/docs) [Technology areas](https://docs.cloud.google.com/docs/tech-area-overviews) - [AI and ML](https://docs.cloud.google.com/docs/ai-ml) - [Application development](https://docs.cloud.google.com/docs/application-development) - [Application hosting](https://docs.cloud.google.com/docs/application-hosting) - [Compute](https://docs.cloud.google.com/docs/compute-area) - [Data analytics and pipelines](https://docs.cloud.google.com/docs/data) - [Databases](https://docs.cloud.google.com/docs/databases) - [Distributed, hybrid, and multicloud](https://docs.cloud.google.com/docs/dhm-cloud) - [Generative AI](https://docs.cloud.google.com/docs/generative-ai) - [Industry solutions](https://docs.cloud.google.com/docs/industry) - [Networking](https://docs.cloud.google.com/docs/networking) - [Observability and monitoring](https://docs.cloud.google.com/docs/observability) - [Security](https://docs.cloud.google.com/docs/security) - [Storage](https://docs.cloud.google.com/docs/storage) [Cross-product tools](https://docs.cloud.google.com/docs/cross-product-overviews) - [Access and resources management](https://docs.cloud.google.com/docs/access-resources) - [Costs and usage management](https://docs.cloud.google.com/docs/costs-usage) - [Google Cloud SDK, languages, frameworks, and tools](https://docs.cloud.google.com/docs/devtools) - [Infrastructure as code](https://docs.cloud.google.com/docs/iac) - [Migration](https://docs.cloud.google.com/docs/migration) [Console](https://console.cloud.google.com/) - [English]() - [Deutsch]() - [Español]() - [Español – América Latina]() - [Français]() - [Indonesia]() - [Italiano]() - [Português]() - [Português – Brasil]() - [中文 – 简体]() - [中文 – 繁體]() - [日本語]() - [한국어]() Sign in [![](https://docs.cloud.google.com/_static/clouddocs/images/icons/categories/devops-color.svg)](https://docs.cloud.google.com/docs/authentication) - [Google Cloud SDK](https://docs.cloud.google.com/sdk/docs) - [Authentication](https://docs.cloud.google.com/docs/authentication) [Start free](https://console.cloud.google.com/freetrial) [Guides](https://docs.cloud.google.com/sdk/docs/install-sdk) [Reference](https://docs.cloud.google.com/sdk/docs/libraries-reference) [Resources](https://docs.cloud.google.com/sdk/docs/resources) [![Google Cloud Documentation](https://www.gstatic.com/devrel-devsite/prod/v59c691115ec6a53e3bf17af135bec44a3bb95c23eb778b8c9e469e221a6634ea/clouddocs/images/lockup.svg)](https://docs.cloud.google.com/) - [Documentation](https://docs.cloud.google.com/docs) - [Guides](https://docs.cloud.google.com/sdk/docs/install-sdk) - [Reference](https://docs.cloud.google.com/sdk/docs/libraries-reference) - [Resources](https://docs.cloud.google.com/sdk/docs/resources) - [Technology areas](https://docs.cloud.google.com/docs/tech-area-overviews) - More - [Cross-product tools](https://docs.cloud.google.com/docs/cross-product-overviews) - More - [Console](https://console.cloud.google.com/) - Discover - [Google Cloud SDK overview](https://docs.cloud.google.com/sdk) - [gcloud CLI overview](https://docs.cloud.google.com/sdk/gcloud) - [Cloud Client Libraries overview](https://docs.cloud.google.com/apis/docs/cloud-client-libraries) - [Client libraries and Cloud APIs explained](https://docs.cloud.google.com/apis/docs/client-libraries-explained) - Get started - [Install the Google Cloud CLI](https://docs.cloud.google.com/sdk/docs/install-sdk) - Other CLI installation methods - [Recommended installation](https://docs.cloud.google.com/sdk/docs/install) - Other installation methods - Using Docker - [Overview](https://docs.cloud.google.com/sdk/docs/downloads-docker) - [Migrate to the :stable image](https://docs.cloud.google.com/sdk/docs/migrate-docker-images) - [Using a snap package](https://docs.cloud.google.com/sdk/docs/downloads-snap) - [Using versioned archives](https://docs.cloud.google.com/sdk/docs/downloads-versioned-archives) - [Using the installer](https://docs.cloud.google.com/sdk/docs/downloads-interactive) - Authenticate to Google Cloud - [Authentication methods at Google](https://docs.cloud.google.com/docs/authentication) - Ways to authenticate - [Authenticate for using client libraries](https://docs.cloud.google.com/docs/authentication/client-libraries) - [Authenticate for using the gcloud CLI](https://docs.cloud.google.com/docs/authentication/gcloud) - [Authenticate for using REST](https://docs.cloud.google.com/docs/authentication/rest) - [Authenticate by using service account impersonation](https://docs.cloud.google.com/docs/authentication/use-service-account-impersonation) - Application Default Credentials - Set up Application Default Credentials - [Overview](https://docs.cloud.google.com/docs/authentication/provide-credentials-adc) - [Local development environment](https://docs.cloud.google.com/docs/authentication/set-up-adc-local-dev-environment) - [Resource with an attached service account](https://docs.cloud.google.com/docs/authentication/set-up-adc-attached-service-account) - [Containerized environment](https://docs.cloud.google.com/docs/authentication/set-up-adc-containerized-environment) - [On-premises or another cloud provider](https://docs.cloud.google.com/docs/authentication/set-up-adc-on-premises) - [Cloud-based development environment](https://docs.cloud.google.com/docs/authentication/set-up-adc-cloud-dev-environment) - [How Application Default Credentials works](https://docs.cloud.google.com/docs/authentication/application-default-credentials) - [Troubleshoot your ADC setup](https://docs.cloud.google.com/docs/authentication/troubleshoot-adc) - API keys - [Use API keys to access APIs](https://docs.cloud.google.com/docs/authentication/api-keys-use) - [Manage API keys](https://docs.cloud.google.com/docs/authentication/api-keys) - [Best practices for managing API keys](https://docs.cloud.google.com/docs/authentication/api-keys-best-practices) - [Get an ID token](https://docs.cloud.google.com/docs/authentication/get-id-token) - Tokens - [Overview](https://docs.cloud.google.com/docs/authentication/tokens) - [Token types](https://docs.cloud.google.com/docs/authentication/token-types) - [Multi-factor authentication requirement](https://docs.cloud.google.com/docs/authentication/mfa-requirement) - [Reauthentication](https://docs.cloud.google.com/docs/authentication/reauthentication) - [Authentication use cases](https://docs.cloud.google.com/docs/authentication/use-cases) - [Identity management products](https://docs.cloud.google.com/docs/authentication/identity-products) - Configure the gcloud CLI - [Initialize the gcloud CLI](https://docs.cloud.google.com/sdk/docs/initializing) - [Authorize the gcloud CLI](https://docs.cloud.google.com/sdk/docs/authorizing) - [Configure the gcloud CLI for use behind a proxy or firewall](https://docs.cloud.google.com/sdk/docs/proxy-settings) - [Manage gcloud CLI configurations](https://docs.cloud.google.com/sdk/docs/configurations) - [Manage gcloud CLI properties](https://docs.cloud.google.com/sdk/docs/properties) - [Enable accessibility features](https://docs.cloud.google.com/sdk/docs/enabling-accessibility-features) - Develop - [gcloud CLI cheat sheet](https://docs.cloud.google.com/sdk/docs/cheatsheet) - [Scripting gcloud CLI commands](https://docs.cloud.google.com/sdk/docs/scripting-gcloud) - [Client libraries best practices](https://docs.cloud.google.com/apis/docs/client-libraries-best-practices) - Manage packages in gcloud CLI - [Managing gcloud CLI components](https://docs.cloud.google.com/sdk/docs/components) - [Uninstalling the gcloud CLI](https://docs.cloud.google.com/sdk/docs/uninstall-cloud-sdk) - [AI and ML](https://docs.cloud.google.com/docs/ai-ml) - [Application development](https://docs.cloud.google.com/docs/application-development) - [Application hosting](https://docs.cloud.google.com/docs/application-hosting) - [Compute](https://docs.cloud.google.com/docs/compute-area) - [Data analytics and pipelines](https://docs.cloud.google.com/docs/data) - [Databases](https://docs.cloud.google.com/docs/databases) - [Distributed, hybrid, and multicloud](https://docs.cloud.google.com/docs/dhm-cloud) - [Generative AI](https://docs.cloud.google.com/docs/generative-ai) - [Industry solutions](https://docs.cloud.google.com/docs/industry) - [Networking](https://docs.cloud.google.com/docs/networking) - [Observability and monitoring](https://docs.cloud.google.com/docs/observability) - [Security](https://docs.cloud.google.com/docs/security) - [Storage](https://docs.cloud.google.com/docs/storage) - [Access and resources management](https://docs.cloud.google.com/docs/access-resources) - [Costs and usage management](https://docs.cloud.google.com/docs/costs-usage) - [Google Cloud SDK, languages, frameworks, and tools](https://docs.cloud.google.com/docs/devtools) - [Infrastructure as code](https://docs.cloud.google.com/docs/iac) - [Migration](https://docs.cloud.google.com/docs/migration) - [Home](https://docs.cloud.google.com/) - [Documentation](https://docs.cloud.google.com/docs) - [Application development](https://docs.cloud.google.com/docs/application-development) - [Google Cloud SDK](https://docs.cloud.google.com/sdk/docs) - [Authentication](https://docs.cloud.google.com/docs/authentication) - [Guides](https://docs.cloud.google.com/sdk/docs/install-sdk) Send feedback # Manage API keysStay organized with collections Save and categorize content based on your preferences. This page describes how to create, edit, and restrict API keys. For information about how to use API keys to access Google APIs, see [Use API keys to access APIs](https://docs.cloud.google.com/docs/authentication/api-keys-use). ## Introduction to API keys There are two types of API keys: standard API keys, and API keys that have been bound to a service account. ### Standard API keys Standard API keys provide a way to associate a request with a project for billing and quota purposes. When you use a standard API key (an API key that has not been bound to a service account) to access an API, the API key doesn't identify a [principal](https://docs.cloud.google.com/docs/authentication#principal). Without a principal, the request can't use Identity and Access Management (IAM) to check whether the caller is authorized to perform the requested operation. Standard API keys can be used with any API that accepts API keys, unless API restrictions have been added to the key. Standard API keys can't be used with services that don't accept API keys, including in [express mode](https://cloud.google.com/resources/cloud-express-faqs). ### API keys bound to a service account API keys bound to a service account provide the identity and authorization of the service account to a request. When you use an API key that has been bound to a service account to access an API, your request is processed as if you used the bound service account to make the request. The only API that supports bound API keys is `aiplatform.googleapis.com`. Caution: API keys bound to service accounts are designed to accelerate the initial experience for developers exploring Google Cloud APIs. Don't use them in production environments. Instead, plan to migrate to more secure alternatives such as [IAM](https://docs.cloud.google.com/iam/docs/grant-role-console) policies and [short-lived service account credentials](https://docs.cloud.google.com/iam/docs/service-account-creds#short-lived-credentials), following least-privilege security practices. Read more about [the risks of API keys bound to service accounts](https://docs.cloud.google.com/docs/authentication/api-keys-best-practices#service-accounts-api-keys). Binding keys to a service account is prevented by a default organization policy constraint. To change this, see [Enable key binding to service accounts](https://docs.cloud.google.com/docs/authentication/api-keys#enable-key-binding). Note: Requests authenticated by API keys bound to service accounts aren't recorded in [service account usage metrics](https://docs.cloud.google.com/iam/docs/service-account-monitoring). ### API key components An API key has the following components, which let you manage and use the key: String The API key string is an encrypted string, for example, `AIzaSyDaGmWKa4JsXZ-HjGw7ISLn_3namBGewQe`. When you use an API key to access an API, you always use the key's string. API keys don't have an associated JSON file. ID The API key ID is used by Google Cloud administrative tools to uniquely identify the key. The key ID can't be used to access APIs. The key ID can be found in the URL of the key's edit page in the Google Cloud console. You can also get the key ID by using the Google Cloud CLI to list the keys in your project. Display name The display name is an optional, descriptive name for the key, which you can set when you create or update the key. Bound service account API keys that are bound to a service account include the service account's email address. ## Before you begin Complete the following tasks to use the samples on this page. ### Set up authentication Select the tab for how you plan to use the samples on this page: ### Console When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication. ### gcloud In the Google Cloud console, activate Cloud Shell. [Activate Cloud Shell](https://console.cloud.google.com/?cloudshell=true) At the bottom of the Google Cloud console, a [Cloud Shell](https://docs.cloud.google.com/shell/docs/how-cloud-shell-works) session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize. ### C++ To use the C++ samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials. 1. [Install](https://docs.cloud.google.com/sdk/docs/install) the Google Cloud CLI. 2. If you're using an external identity provider (IdP), you must first [sign in to the gcloud CLI with your federated identity](https://docs.cloud.google.com/iam/docs/workforce-log-in-gcloud). 3. If you're using a local shell, then create local authentication credentials for your user account: ``` gcloud auth application-default login ``` You don't need to do this if you're using Cloud Shell. If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have [signed in to the gcloud CLI with your federated identity](https://docs.cloud.google.com/iam/docs/workforce-log-in-gcloud). For more information, see [Set up ADC for a local development environment](https://docs.cloud.google.com/docs/authentication/set-up-adc-local-dev-environment) in the Google Cloud authentication documentation. ### Java To use the Java samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials. 1. [Install](https://docs.cloud.google.com/sdk/docs/install) the Google Cloud CLI. 2. If you're using an external identity provider (IdP), you must first [sign in to the gcloud CLI with your federated identity](https://docs.cloud.google.com/iam/docs/workforce-log-in-gcloud). 3. If you're using a local shell, then create local authentication credentials for your user account: ``` gcloud auth application-default login ``` You don't need to do this if you're using Cloud Shell. If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have [signed in to the gcloud CLI with your federated identity](https://docs.cloud.google.com/iam/docs/workforce-log-in-gcloud). For more information, see [Set up ADC for a local development environment](https://docs.cloud.google.com/docs/authentication/set-up-adc-local-dev-environment) in the Google Cloud authentication documentation. ### Python To use the Python samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials. 1. [Install](https://docs.cloud.google.com/sdk/docs/install) the Google Cloud CLI. 2. If you're using an external identity provider (IdP), you must first [sign in to the gcloud CLI with your federated identity](https://docs.cloud.google.com/iam/docs/workforce-log-in-gcloud). 3. If you're using a local shell, then create local authentication credentials for your user account: ``` gcloud auth application-default login ``` You don't need to do this if you're using Cloud Shell. If an authentication error is returned, and you are using an external identity provider (IdP), confirm that you have [signed in to the gcloud CLI with your federated identity](https://docs.cloud.google.com/iam/docs/workforce-log-in-gcloud). For more information, see [Set up ADC for a local development environment](https://docs.cloud.google.com/docs/authentication/set-up-adc-local-dev-environment) in the Google Cloud authentication documentation. ### REST To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI. For more information, see [Authenticate for using REST](https://docs.cloud.google.com/docs/authentication/rest) in the Google Cloud authentication documentation. ### Required roles To get the permissions that you need to manage API keys, ask your administrator to grant you the following IAM roles on your project: - [API Keys Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/serviceusage#serviceusage.apiKeysAdmin) (`roles/serviceusage.apiKeysAdmin`) - Restrict an API key to specific APIs by using the Google Cloud console: [Service Usage Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/serviceusage#serviceusage.serviceUsageViewer) (`roles/serviceusage.serviceUsageViewer`) For more information about granting roles, see [Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access). You might also be able to get the required permissions through [custom roles](https://docs.cloud.google.com/iam/docs/creating-custom-roles) or other [predefined roles](https://docs.cloud.google.com/iam/docs/roles-overview#predefined). ### Enable key binding to service accounts Before you can [bind an API key to a service account](https://docs.cloud.google.com/docs/authentication/api-keys#api-keys-bound-sa), you first need to set the `constraints/iam.managed.disableServiceAccountApiKeyCreation` organization policy constraint to `false`. Changing the organization policy requires an associated [organization resource](https://docs.cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy#organizations). Projects without an organization aren't supported. To change the policy constraint, complete the following instructions. ### Console 1. In the Google Cloud console, go to the Organization policies page. [Go to Organization policies](https://console.cloud.google.com/iam-admin/orgpolicies/list) 2. Switch to the organization, folder, or project you want to change the policies for. 3. In the Filter box, enter `Block service`, and then click the filter name Block service account API key bindings. 4. Click Manage policy. 5. In the Policy source section, select Override parent's policy. 6. Click Add a rule, and set Enforcement to Off. 7. Click Done. 8. Optional: Click Test changes to give you insight on how the proposed policy might cause compliance violations or disruptions. 9. Click Set policy. ### gcloud 1. Create a file named `spec.yaml`, with the following content: ``` name: SCOPE/ SCOPE_ID /policies/iam.managed.disableServiceAccountApiKeyCreation spec: rules: - enforce: false ``` Provide the following values: - `SCOPE`: Either `organizations`, `folders`, or `projects`. - `SCOPE_ID`: Depending on SCOPE, the ID of the organization, folder, or project to which the organization policy applies. 2. Run the following `gcloud` command to allow binding of API keys to service accounts: ``` gcloud org-policies set-policy spec.yaml \ --update-mask spec ``` ## Create an API key To create an API key, use one of the following options: ### Console 1. In the Google Cloud console, go to the Credentials page: [Go to Credentials](https://console.cloud.google.com/apis/credentials) 2. Click Create credentials, and then select API key from the menu. 3. Optional: To bind the API key to a service account, select the Authenticate API calls through a service account checkbox and then click Select a service account to select the service account you want to bind to the key. For more information, see [API keys bound to a service account](https://docs.cloud.google.com/docs/authentication/api-keys#api-keys-bound-sa). 4. Add API key restrictions. Restricting API keys is a best practice. For more information, see [Apply API key restrictions](https://docs.cloud.google.com/docs/authentication/api-keys#api_key_restrictions). 5. Click Create. The API key created dialog displays the string for your newly created key. ### gcloud You use the [`gcloud services api-keys create` command](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/create) to create an API key. Replace `DISPLAY_NAME` with a descriptive name for your key. ``` gcloud services api-keys create \ --display-name=DISPLAY_NAME ``` Optional: To bind the API key to a service account, use `gcloud beta` instead, with the `--service-account` flag: ``` gcloud beta services api-keys create \ --display-name=DISPLAY_NAME \ --service-account=SERVICE_ACCOUNT_EMAIL_ADDRESS ``` For more information, see [API keys bound to a service account](https://docs.cloud.google.com/docs/authentication/api-keys#api-keys-bound-sa). ### C++ To run this sample, you must install the [API Keys client library](https://docs.cloud.google.com/cpp/docs/reference/apikeys/latest). ``` #include "google/cloud/apikeys/v2/api_keys_client.h" #include "google/cloud/location.h" google::api::apikeys::v2::Key CreateApiKey( google::cloud::apikeys_v2::ApiKeysClient client, google::cloud::Location location, std::string display_name) { google::api::apikeys::v2::CreateKeyRequest request; request.set_parent(location.FullName()); request.mutable_key()->set_display_name(std::move(display_name)); // As an example, restrict the API key's scope to the Natural Language API. request.mutable_key()->mutable_restrictions()->add_api_targets()->set_service( "language.googleapis.com"); // Create the key, blocking on the result. auto key = client.CreateKey(request).get(); if (!key) throw std::move(key.status()); std::cout << "Successfully created an API key: " << key->name() << "\n"; // For authenticating with the API key, use the value in `key->key_string()`. // The API key's resource name is the value in `key->name()`. Use this to // refer to the specific key in a `GetKey()` or `DeleteKey()` RPC. return key; } ``` ### Java To run this sample, you must install the [`google-cloud-apikeys` client library](https://docs.cloud.google.com/java/docs/reference/google-cloud-apikeys/latest/overview). ``` import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.ApiTarget; import com.google.api.apikeys.v2.CreateKeyRequest; import com.google.api.apikeys.v2.Key; import com.google.api.apikeys.v2.LocationName; import com.google.api.apikeys.v2.Restrictions; import java.io.IOException; import java.util.concurrent.ExecutionException; import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; public class CreateApiKey { public static void main(String[] args) throws IOException, ExecutionException, InterruptedException, TimeoutException { // TODO(Developer): Before running this sample, // 1. Replace the variable(s) below. // 2. Set up ADC as described in https://cloud.google.com/docs/authentication/external/set-up-adc // 3. Make sure you have the necessary permission to create API keys. String projectId = "GOOGLE_CLOUD_PROJECT_ID"; createApiKey(projectId); } // Creates an API key. public static void createApiKey(String projectId) throws IOException, ExecutionException, InterruptedException, TimeoutException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. After completing all of your requests, call // the `apiKeysClient.close()` method on the client to safely // clean up any remaining background resources. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { Key key = Key.newBuilder() .setDisplayName("My first API key") // Set the API key restriction. // You can also set browser/ server/ android/ ios based restrictions. // For more information on API key restriction, see: // https://cloud.google.com/docs/authentication/api-keys#api_key_restrictions .setRestrictions(Restrictions.newBuilder() // Restrict the API key usage by specifying the target service and methods. // The API key can only be used to authenticate the specified methods in the service. .addApiTargets(ApiTarget.newBuilder() .setService("translate.googleapis.com") .addMethods("translate.googleapis.com.TranslateText") .build()) .build()) .build(); // Initialize request and set arguments. CreateKeyRequest createKeyRequest = CreateKeyRequest.newBuilder() // API keys can only be global. .setParent(LocationName.of(projectId, "global").toString()) .setKey(key) .build(); // Make the request and wait for the operation to complete. Key result = apiKeysClient.createKeyAsync(createKeyRequest).get(3, TimeUnit.MINUTES); // For authenticating with the API key, use the value in "result.getKeyString()". // To restrict the usage of this API key, use the value in "result.getName()". System.out.printf("Successfully created an API key: %s", result.getName()); } } } ``` ### Python To run this sample, you must install the [API Keys client library](https://docs.cloud.google.com/python/docs/reference/apikeys/latest). ``` from google.cloud import api_keys_v2 from google.cloud.api_keys_v2 import Key def create_api_key(project_id: str, suffix: str) -> Key: """ Creates and restrict an API key. Add the suffix for uniqueness. TODO(Developer): 1. Before running this sample, set up ADC as described in https://cloud.google.com/docs/authentication/external/set-up-adc 2. Make sure you have the necessary permission to create API keys. Args: project_id: Google Cloud project id. Returns: response: Returns the created API Key. """ # Create the API Keys client. client = api_keys_v2.ApiKeysClient() key = api_keys_v2.Key() key.display_name = f"My first API key - {suffix}" # Initialize request and set arguments. request = api_keys_v2.CreateKeyRequest() request.parent = f"projects/{project_id}/locations/global" request.key = key # Make the request and wait for the operation to complete. response = client.create_key(request=request).result() print(f"Successfully created an API key: {response.name}") # For authenticating with the API key, use the value in "response.key_string". # To restrict the usage of this API key, use the value in "response.name". return response ``` ### REST You use the [`keys.create` method](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/projects.locations.keys/create) to create an API key. This request returns a [long-running operation](https://docs.cloud.google.com/docs/authentication/api-keys#lro); you must poll the operation to get the information for the new key. Replace the following values: - `DISPLAY_NAME`: Optional. A descriptive name for your key. - `PROJECT_ID`: Your Google Cloud project ID or name. ``` curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d {'"displayName" : " DISPLAY_NAME "'} \ "https://apikeys.googleapis.com/v2/projects/ PROJECT /locations/global/keys" ``` Optional: To bind the API key to a service account instead, use the following command: ``` curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ -d {'"displayName" : " DISPLAY_NAME ", "serviceAccountEmail" : " SERVICE_ACCOUNT_EMAIL "'} \ "https://apikeys.googleapis.com/v2/projects/ PROJECT /locations/global/keys" ``` For more information, see [API keys bound to a service account](https://docs.cloud.google.com/docs/authentication/api-keys#api-keys-bound-sa). For more information about creating API keys using the REST API, see [Creating an API key](https://docs.cloud.google.com/api-keys/docs/create-manage-api-keys#create) in the API Keys API documentation. Important:* Copy your key string and keep it secure. Use API key restrictions to limit how the key can be used. ## Apply API key restrictions API keys are unrestricted by default. Unrestricted keys are insecure because they can be used by anyone from anywhere. For production applications, you should set both [application restrictions](https://docs.cloud.google.com/docs/authentication/api-keys#adding-application-restrictions) and [API restrictions](https://docs.cloud.google.com/docs/authentication/api-keys#adding-api-restrictions). ### Add application restrictions Application restrictions specify which websites, IP addresses, or apps can use an API key. You can apply only one application restriction type at a time. Choose the restriction type based on your application type: \| Option \| Application type \| Notes \| \|---\|---\|---\| \| [HTTP referrers](https://docs.cloud.google.com/docs/authentication/api-keys#http) \| Web applications \| Specifies the websites that can use the key. \| \| [IP Addresses](https://docs.cloud.google.com/docs/authentication/api-keys#ip) \| Applications called by specific servers \| Specifies the servers or cron jobs that can use the key. This is the only restriction available if you bind your API key to a service account. \| \| [Android apps](https://docs.cloud.google.com/docs/authentication/api-keys#android) \| Android applications \| Specifies the Android application that can use the key. \| \| [iOS apps](https://docs.cloud.google.com/docs/authentication/api-keys#ios) \| iOS applications \| Specifies the iOS bundles that can use the key. \| #### HTTP referrers To restrict the websites that can use your API key, you add one or more HTTP referrer restrictions. You can substitute a wildcard character (``) for the subdomain or the path, but you can't insert a wildcard character into the middle of the URL. For example, `.example.com` is valid, and accepts all sites ending in `.example.com`. However, `mysubdomain.example.com` is not a valid restriction. Port numbers can be included in HTTP referrer restrictions. If you include a port number, then only requests using that port are matched. If you don't specify a port number, then requests from any port number are matched. The following table shows some example scenarios and browser restrictions: \| Scenario* \| Restrictions \| \|---\|---\| \| Allow a specific URL \| Add a URL with an exact path. For example: `www.example.com/path` `www.example.com/path/path` Some browsers implement a [referrer policy](https://developer.chrome.com/blog/referrer-policy-new-chrome-default/) that sends only the origin URL for cross-origin requests. Users of these browsers can't use keys with page-specific URL restrictions. \| \| Allow any URL in your site \| You must set two URLs in the `allowedReferers` list. URL for the domain, without a subdomain, and with a wildcard for the path. For example: `example.com/` A second URL that includes a wildcard for the subdomain and a wildcard for the path. For example: `.example.com/` \| \| Allow any URL in a single subdomain or naked domain \| You must set two URLs in the `allowedReferers` list to allow an entire domain: URL for the domain, without a trailing slash. For example: `www.example.com` `sub.example.com` `example.com` A second URL for the domain that includes a wildcard for the path. For example: `www.example.com/` `sub.example.com/` `example.com/` \| To restrict your API key to specific websites, use one of the following options: ### Console 1. In the Google Cloud console, go to the Credentials page: [Go to Credentials](https://console.cloud.google.com/apis/credentials) 2. Click the name of the API key that you want to restrict. 3. In the Application restrictions section, select HTTP referrers. 4. For each restriction that you want to add, click Add an item, enter the restriction, and click Done. 5. Click Save to save your changes and return to the API key list. ### gcloud 1. Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the [`gcloud services api-keys list` command](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/list) to list the keys in your project. 2. Use the [`gcloud services api-keys update` command](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/update) to add HTTP referrer restrictions to an API key. Replace the following values: - `KEY_ID`: The ID of the key that you want to restrict. - `ALLOWED_REFERRER_1`: Your HTTP referrer restriction. You can add as many restrictions as needed; use commas to separate the restrictions. You must provide all referrer restrictions with the update command; the referrer restrictions provided replace any existing referrer restrictions on the key. ``` gcloud services api-keys update KEY_ID \ --allowed-referrers=" ALLOWED_REFERRER_1 " ``` ### Java To run this sample, you must install the [`google-cloud-apikeys` client library](https://docs.cloud.google.com/java/docs/reference/google-cloud-apikeys/latest/overview). ``` import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.BrowserKeyRestrictions; import com.google.api.apikeys.v2.Key; import com.google.api.apikeys.v2.Restrictions; import com.google.api.apikeys.v2.UpdateKeyRequest; import com.google.protobuf.FieldMask; import java.io.IOException; import java.util.concurrent.ExecutionException; import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; public class RestrictApiKeyHttp { public static void main(String[] args) throws IOException, ExecutionException, InterruptedException, TimeoutException { // TODO(Developer): Before running this sample, // 1. Replace the variable(s) below. String projectId = "GOOGLE_CLOUD_PROJECT_ID"; // ID of the key to restrict. This ID is auto-created during key creation. // This is different from the key string. To obtain the key_id, // you can also use the lookup api: client.lookupKey() String keyId = "key_id"; restrictApiKeyHttp(projectId, keyId); } // Restricts an API key. To restrict the websites that can use your API key, // you add one or more HTTP referrer restrictions. public static void restrictApiKeyHttp(String projectId, String keyId) throws IOException, ExecutionException, InterruptedException, TimeoutException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. After completing all of your requests, call // the `apiKeysClient.close()` method on the client to safely // clean up any remaining background resources. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { // Restrict the API key usage to specific websites by adding them // to the list of allowed_referrers. Restrictions restrictions = Restrictions.newBuilder() .setBrowserKeyRestrictions(BrowserKeyRestrictions.newBuilder() .addAllowedReferrers("www.example.com/") .build()) .build(); Key key = Key.newBuilder() .setName(String.format("projects/%s/locations/global/keys/%s", projectId, keyId)) // Set the restriction(s). // For more information on API key restriction, see: // https://cloud.google.com/docs/authentication/api-keys .setRestrictions(restrictions) .build(); // Initialize request and set arguments. UpdateKeyRequest updateKeyRequest = UpdateKeyRequest.newBuilder() .setKey(key) .setUpdateMask(FieldMask.newBuilder().addPaths("restrictions").build()) .build(); // Make the request and wait for the operation to complete. Key result = apiKeysClient.updateKeyAsync(updateKeyRequest).get(3, TimeUnit.MINUTES); // For authenticating with the API key, use the value in "result.getKeyString()". System.out.printf("Successfully updated the API key: %s", result.getName()); } } } ``` ### Python To run this sample, you must install the [API Keys client library](https://docs.cloud.google.com/python/docs/reference/apikeys/latest). ``` from google.cloud import api_keys_v2 from google.cloud.api_keys_v2 import Key def restrict_api_key_http(project_id: str, key_id: str) -> Key: """ Restricts an API key. To restrict the websites that can use your API key, you add one or more HTTP referrer restrictions. TODO(Developer): Replace the variables before running this sample. Args: project_id: Google Cloud project id. key_id: ID of the key to restrict. This ID is auto-created during key creation. This is different from the key string. To obtain the key_id, you can also use the lookup api: client.lookup_key() Returns: response: Returns the updated API Key. """ # Create the API Keys client. client = api_keys_v2.ApiKeysClient() # Restrict the API key usage to specific websites by adding them to the list of allowed_referrers. browser_key_restrictions = api_keys_v2.BrowserKeyRestrictions() browser_key_restrictions.allowed_referrers = ["www.example.com/"] # Set the API restriction. # For more information on API key restriction, see: # https://cloud.google.com/docs/authentication/api-keys restrictions = api_keys_v2.Restrictions() restrictions.browser_key_restrictions = browser_key_restrictions key = api_keys_v2.Key() key.name = f"projects/{project_id}/locations/global/keys/{key_id}" key.restrictions = restrictions # Initialize request and set arguments. request = api_keys_v2.UpdateKeyRequest() request.key = key request.update_mask = "restrictions" # Make the request and wait for the operation to complete. response = client.update_key(request=request).result() print(f"Successfully updated the API key: {response.name}") # Use response.key_string to authenticate. return response ``` ### REST 1. Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the [keys.list](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/projects.locations.keys/list) method. The ID is listed in the `uid` field of the response. Replace `PROJECT_ID` with your Google Cloud project ID or name. ``` curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/" ``` 2. Use the [keys.patch](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/projects.locations.keys/patch) method to add HTTP referrer restrictions to the API key. This request returns a [long-running operation](https://docs.cloud.google.com/docs/authentication/api-keys#lro); you must poll the operation to know when the operation completes and get the operation status. Replace the following values: - `ALLOWED_REFERRER_1`: Your HTTP referrer restriction. You can add as many restrictions as needed; use commas to separate the restrictions. You must provide all referrer restrictions with the request; the referrer restrictions provided replace any existing referrer restrictions on the key. - `PROJECT_ID`: Your Google Cloud project ID or name. - `KEY_ID`: The ID of the key that you want to restrict. ``` curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "browserKeyRestrictions": { "allowedReferrers": [" ALLOWED_REFERRER_1 "] } } }' \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/ KEY_ID ?updateMask=restrictions" ``` For more information about adding HTTP referrer restrictions to a key using the REST API, see [Adding browser restrictions](https://docs.cloud.google.com/api-keys/docs/add-restrictions-api-keys#adding_browser_restrictions) in the API Keys API documentation. #### IP Addresses You can specify one or more IP addresses of the callers, such as a web server or cron job, that are allowed to use your API key. You can specify the IP addresses in any of the following formats: - IPv4 (`198.51.100.1`) - IPv6 (`2001:db8::1`) - A subnet using CIDR notation (`198.51.100.0/24`, `2001:db8::/64`) Using `localhost` is not supported for server restrictions. To restrict your API key to specific IP addresses, use one of the following options: ### Console 1. In the Google Cloud console, go to the Credentials page: [Go to Credentials](https://console.cloud.google.com/apis/credentials) 2. Click the name of the API key that you want to restrict. 3. In the Application restrictions section, select IP addresses. 4. For each IP address that you want to add, click Add an item, enter the address, and click Done. 5. Click Save to save your changes and return to the API key list. ### gcloud 1. Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the [`gcloud services api-keys list` command](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/list) to list the keys in your project. 2. Use the [`gcloud services api-keys update` command](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/update) to add server (IP address) restrictions to an API key. Replace the following values: - `KEY_ID`: The ID of the key that you want to restrict. - `ALLOWED_IP_ADDR_1`: Your allowed IP address. You can add as many IP addresses as needed; use commas to separate the addresses. ``` gcloud services api-keys update KEY_ID \ --allowed-ips=" ALLOWED_IP_ADDR_1 " ``` ### Java To run this sample, you must install the [`google-cloud-apikeys` client library](https://docs.cloud.google.com/java/docs/reference/google-cloud-apikeys/latest/overview). ``` import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.Key; import com.google.api.apikeys.v2.Restrictions; import com.google.api.apikeys.v2.ServerKeyRestrictions; import com.google.api.apikeys.v2.UpdateKeyRequest; import com.google.protobuf.FieldMask; import java.io.IOException; import java.util.Arrays; import java.util.concurrent.ExecutionException; import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; public class RestrictApiKeyServer { public static void main(String[] args) throws IOException, ExecutionException, InterruptedException, TimeoutException { // TODO(Developer): Before running this sample, // 1. Replace the variable(s) below. String projectId = "GOOGLE_CLOUD_PROJECT_ID"; // ID of the key to restrict. This ID is auto-created during key creation. // This is different from the key string. To obtain the key_id, // you can also use the lookup api: client.lookupKey() String keyId = "key_id"; restrictApiKeyServer(projectId, keyId); } // Restricts the API key based on IP addresses. You can specify one or more IP addresses // of the callers, for example web servers or cron jobs, that are allowed to use your API key. public static void restrictApiKeyServer(String projectId, String keyId) throws IOException, ExecutionException, InterruptedException, TimeoutException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. After completing all of your requests, call // the `apiKeysClient.close()` method on the client to safely // clean up any remaining background resources. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { // Restrict the API key usage by specifying the IP addresses. // You can specify the IP addresses in IPv4 or IPv6 or a subnet using CIDR notation. Restrictions restrictions = Restrictions.newBuilder() .setServerKeyRestrictions(ServerKeyRestrictions.newBuilder() .addAllAllowedIps(Arrays.asList("198.51.100.0/24", "2000:db8::/64")) .build()) .build(); Key key = Key.newBuilder() .setName(String.format("projects/%s/locations/global/keys/%s", projectId, keyId)) // Set the restriction(s). // For more information on API key restriction, see: // https://cloud.google.com/docs/authentication/api-keys .setRestrictions(restrictions) .build(); // Initialize request and set arguments. UpdateKeyRequest updateKeyRequest = UpdateKeyRequest.newBuilder() .setKey(key) .setUpdateMask(FieldMask.newBuilder().addPaths("restrictions").build()) .build(); // Make the request and wait for the operation to complete. Key result = apiKeysClient.updateKeyAsync(updateKeyRequest).get(3, TimeUnit.MINUTES); // For authenticating with the API key, use the value in "result.getKeyString()". System.out.printf("Successfully updated the API key: %s", result.getName()); } } } ``` ### Python To run this sample, you must install the [API Keys client library](https://docs.cloud.google.com/python/docs/reference/apikeys/latest). ``` from google.cloud import api_keys_v2 from google.cloud.api_keys_v2 import Key def restrict_api_key_server(project_id: str, key_id: str) -> Key: """ Restricts the API key based on IP addresses. You can specify one or more IP addresses of the callers, for example web servers or cron jobs, that are allowed to use your API key. TODO(Developer): Replace the variables before running this sample. Args: project_id: Google Cloud project id. key_id: ID of the key to restrict. This ID is auto-created during key creation. This is different from the key string. To obtain the key_id, you can also use the lookup api: client.lookup_key() Returns: response: Returns the updated API Key. """ # Create the API Keys client. client = api_keys_v2.ApiKeysClient() # Restrict the API key usage by specifying the IP addresses. # You can specify the IP addresses in IPv4 or IPv6 or a subnet using CIDR notation. server_key_restrictions = api_keys_v2.ServerKeyRestrictions() server_key_restrictions.allowed_ips = ["198.51.100.0/24", "2000:db8::/64"] # Set the API restriction. # For more information on API key restriction, see: # https://cloud.google.com/docs/authentication/api-keys restrictions = api_keys_v2.Restrictions() restrictions.server_key_restrictions = server_key_restrictions key = api_keys_v2.Key() key.name = f"projects/{project_id}/locations/global/keys/{key_id}" key.restrictions = restrictions # Initialize request and set arguments. request = api_keys_v2.UpdateKeyRequest() request.key = key request.update_mask = "restrictions" # Make the request and wait for the operation to complete. response = client.update_key(request=request).result() print(f"Successfully updated the API key: {response.name}") # Use response.key_string to authenticate. return response ``` ### REST 1. Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the [keys.list](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/projects.locations.keys/list) method. The ID is listed in the `uid` field of the response. Replace `PROJECT_ID` with your Google Cloud project ID or name. ``` curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/" ``` 2. Use the [keys.patch](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/projects.locations.keys/patch) method to add server (IP address) restrictions to an API key. This request returns a [long-running operation](https://docs.cloud.google.com/docs/authentication/api-keys#lro); you must poll the operation to know when the operation completes and get the operation status. Replace the following values: - `ALLOWED_IP_ADDR_1`: Your allowed IP address. You can add as many IP addresses as needed; use commas to separate the restrictions. You must provide all IP addresses with the request; the referrer restrictions provided replace any existing IP address restrictions on the key. - `PROJECT_ID`: Your Google Cloud project ID or name. - `KEY_ID`: The ID of the key that you want to restrict. ``` curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "serverKeyRestrictions": { "allowedIps": [" ALLOWED_IP_ADDR_1 "] } } }' \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/ KEY_ID ?updateMask=restrictions" ``` For more information about adding IP address restrictions to a key using the REST API, see [Adding server restrictions](https://docs.cloud.google.com/api-keys/docs/add-restrictions-api-keys#adding_server_restrictions) in the API Keys API documentation. #### Android apps You can restrict usage of an API key to specific Android apps. You must provide the package name and the 20-byte SHA-1 certificate fingerprint for each app. When you use the API key in a request, you must specify the package name and certificate fingerprint by using the following HTTP headers: - `X-Android-Package` - `X-Android-Cert` Note: Bypassing this restriction is straightforward. If you use this restriction, you should also add API restrictions and monitor usage carefully. To restrict your API key to one or more Android apps, use one of the following options: ### Console 1. In the Google Cloud console, go to the Credentials page: [Go to Credentials](https://console.cloud.google.com/apis/credentials) 2. Click the name of the API key that you want to restrict. 3. In the Application restrictions section, select Android apps. 4. For each Android app that you want to add, click Add an item and enter the package name and SHA-1 certificate fingerprint, then click Done. 5. Click Save to save your changes and return to the API key list. ### gcloud 1. Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the [`gcloud services api-keys list` command](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/list) to list the keys in your project. 2. Use the [`gcloud services api-keys update` command](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/update) to specify the Android apps that can use an API key. Replace the following values: - `KEY_ID`: The ID of the key that you want to restrict. - `SHA1_FINGERPRINT` and `PACKAGE_NAME`: The app information for an Android app that can use the key. You can add as many apps as needed; use additional `--allowed-application` flags. ``` gcloud services api-keys update KEY_ID \ --allowed-application=sha1_fingerprint=SHA1_FINGERPRINT_1,package_name=PACKAGE_NAME_1 \ --allowed-application=sha1_fingerprint=SHA1_FINGERPRINT_2,package_name=PACKAGE_NAME_2 ``` ### Java To run this sample, you must install the [`google-cloud-apikeys` client library](https://docs.cloud.google.com/java/docs/reference/google-cloud-apikeys/latest/overview). ``` import com.google.api.apikeys.v2.AndroidApplication; import com.google.api.apikeys.v2.AndroidKeyRestrictions; import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.Key; import com.google.api.apikeys.v2.Restrictions; import com.google.api.apikeys.v2.UpdateKeyRequest; import com.google.protobuf.FieldMask; import java.io.IOException; import java.util.concurrent.ExecutionException; import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; public class RestrictApiKeyAndroid { public static void main(String[] args) throws IOException, ExecutionException, InterruptedException, TimeoutException { // TODO(Developer): Before running this sample, // 1. Replace the variable(s) below. String projectId = "GOOGLE_CLOUD_PROJECT_ID"; // ID of the key to restrict. This ID is auto-created during key creation. // This is different from the key string. To obtain the key_id, // you can also use the lookup api: client.lookupKey() String keyId = "key_id"; restrictApiKeyAndroid(projectId, keyId); } // Restricts an API key based on android applications. // Specifies the Android application that can use the key. public static void restrictApiKeyAndroid(String projectId, String keyId) throws IOException, ExecutionException, InterruptedException, TimeoutException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. After completing all of your requests, call // the `apiKeysClient.close()` method on the client to safely // clean up any remaining background resources. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { // Restrict the API key usage by specifying the allowed android applications. Restrictions restrictions = Restrictions.newBuilder() .setAndroidKeyRestrictions(AndroidKeyRestrictions.newBuilder() .addAllowedApplications(AndroidApplication.newBuilder() // Specify the android application's package name and SHA1 fingerprint. .setPackageName("com.google.appname") .setSha1Fingerprint("0873D391E987982FBBD30873D391E987982FBBD3") .build()) .build()) .build(); Key key = Key.newBuilder() .setName(String.format("projects/%s/locations/global/keys/%s", projectId, keyId)) // Set the restriction(s). // For more information on API key restriction, see: // https://cloud.google.com/docs/authentication/api-keys .setRestrictions(restrictions) .build(); // Initialize request and set arguments. UpdateKeyRequest updateKeyRequest = UpdateKeyRequest.newBuilder() .setKey(key) .setUpdateMask(FieldMask.newBuilder().addPaths("restrictions").build()) .build(); // Make the request and wait for the operation to complete. Key result = apiKeysClient.updateKeyAsync(updateKeyRequest).get(3, TimeUnit.MINUTES); // For authenticating with the API key, use the value in "result.getKeyString()". System.out.printf("Successfully updated the API key: %s", result.getName()); } } } ``` ### Python To run this sample, you must install the [API Keys client library](https://docs.cloud.google.com/python/docs/reference/apikeys/latest). ``` from google.cloud import api_keys_v2 from google.cloud.api_keys_v2 import Key def restrict_api_key_android(project_id: str, key_id: str) -> Key: """ Restricts an API key based on android applications. Specifies the Android application that can use the key. TODO(Developer): Replace the variables before running this sample. Args: project_id: Google Cloud project id. key_id: ID of the key to restrict. This ID is auto-created during key creation. This is different from the key string. To obtain the key_id, you can also use the lookup api: client.lookup_key() Returns: response: Returns the updated API Key. """ # Create the API Keys client. client = api_keys_v2.ApiKeysClient() # Specify the android application's package name and SHA1 fingerprint. allowed_application = api_keys_v2.AndroidApplication() allowed_application.package_name = "com.google.appname" allowed_application.sha1_fingerprint = "0873D391E987982FBBD30873D391E987982FBBD3" # Restrict the API key usage by specifying the allowed applications. android_key_restriction = api_keys_v2.AndroidKeyRestrictions() android_key_restriction.allowed_applications = [allowed_application] # Set the restriction(s). # For more information on API key restriction, see: # https://cloud.google.com/docs/authentication/api-keys restrictions = api_keys_v2.Restrictions() restrictions.android_key_restrictions = android_key_restriction key = api_keys_v2.Key() key.name = f"projects/{project_id}/locations/global/keys/{key_id}" key.restrictions = restrictions # Initialize request and set arguments. request = api_keys_v2.UpdateKeyRequest() request.key = key request.update_mask = "restrictions" # Make the request and wait for the operation to complete. response = client.update_key(request=request).result() print(f"Successfully updated the API key: {response.name}") # Use response.key_string to authenticate. return response ``` ### REST 1. Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the [keys.list](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/projects.locations.keys/list) method. The ID is listed in the `uid` field of the response. Replace `PROJECT_ID` with your Google Cloud project ID or name. ``` curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/" ``` 2. Use the [keys.patch](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/projects.locations.keys/patch) method to specify the Android apps that can use an API key. This request returns a [long-running operation](https://docs.cloud.google.com/docs/authentication/api-keys#lro); you must poll the operation to know when the operation completes and get the operation status. Replace the following values: - `SHA1_FINGERPRINT_1` and `PACKAGE_NAME_1`: The app information for an Android app that can use the key. You can add the information for as many apps as needed; use commas to separate the [AndroidApplication](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/projects.locations.keys#AndroidApplication) objects. You must provide all applications with the request; the applications provided replace any existing allowed applications on the key. - `PROJECT_ID`: Your Google Cloud project ID or name. - `KEY_ID`: The ID of the key that you want to restrict. ``` curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "androidKeyRestrictions": { "allowedApplications": [ { "sha1Fingerprint": " SHA1_FINGERPRINT_1 ", "packageName": " PACKAGE_NAME_1 " }, ] } } }' \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/ KEY_ID ?updateMask=restrictions" ``` For more information about adding Android app restrictions to a key using the REST API, see [Adding Android restrictions](https://docs.cloud.google.com/api-keys/docs/add-restrictions-api-keys#adding_android_restrictions) in the API Keys API documentation. #### iOS apps You can restrict usage of an API key to specific iOS apps by providing the bundle ID of each app. When you use the API key in a request, you must specify the bundle ID by using the `X-Ios-Bundle-Identifier` HTTP header. Note: Bypassing this restriction is straightforward. If you use this restriction, you should also add API restrictions and monitor usage carefully. To restrict your API key to one or more iOS apps, use one of the following options: ### Console 1. In the Google Cloud console, go to the Credentials page: [Go to Credentials](https://console.cloud.google.com/apis/credentials) 2. Click the name of the API key that you want to restrict. 3. In the Application restrictions section, select iOS apps. 4. For each iOS app that you want to add, click Add an item and enter the bundle ID, then click Done. 5. Click Save to save your changes and return to the API key list. ### gcloud 1. Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the [`gcloud services api-keys list` command](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/list) to list the keys in your project. 2. Use the [`gcloud services api-keys update`](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/update) method to specify the iOS apps that can use the key. Replace the following values: - `KEY_ID`: The ID of the key that you want to restrict. - `ALLOWED_BUNDLE_ID`: The bundle ID of an iOS app that you want to be able to use this API key. You can add as many bundle IDs as needed; use commas to separate the IDs. ``` gcloud services api-keys update KEY_ID \ --allowed-bundle-ids=ALLOWED_BUNDLE_ID_1,ALLOWED_BUNDLE_ID_2 ``` ### Java To run this sample, you must install the [`google-cloud-apikeys` client library](https://docs.cloud.google.com/java/docs/reference/google-cloud-apikeys/latest/overview). ``` import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.IosKeyRestrictions; import com.google.api.apikeys.v2.Key; import com.google.api.apikeys.v2.Restrictions; import com.google.api.apikeys.v2.UpdateKeyRequest; import com.google.protobuf.FieldMask; import java.io.IOException; import java.util.Arrays; import java.util.concurrent.ExecutionException; import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; public class RestrictApiKeyIos { public static void main(String[] args) throws IOException, ExecutionException, InterruptedException, TimeoutException { // TODO(Developer): Before running this sample, // 1. Replace the variable(s) below. String projectId = "GOOGLE_CLOUD_PROJECT_ID"; // ID of the key to restrict. This ID is auto-created during key creation. // This is different from the key string. To obtain the key_id, // you can also use the lookup api: client.lookupKey() String keyId = "key_id"; restrictApiKeyIos(projectId, keyId); } // Restricts an API key. You can restrict usage of an API key to specific iOS apps // by providing the bundle ID of each app. public static void restrictApiKeyIos(String projectId, String keyId) throws IOException, ExecutionException, InterruptedException, TimeoutException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. After completing all of your requests, call // the `apiKeysClient.close()` method on the client to safely // clean up any remaining background resources. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { // Restrict the API key usage by specifying the bundle ID(s) // of iOS app(s) that can use the key. Restrictions restrictions = Restrictions.newBuilder() .setIosKeyRestrictions(IosKeyRestrictions.newBuilder() .addAllAllowedBundleIds(Arrays.asList("com.google.gmail", "com.google.drive")) .build()) .build(); Key key = Key.newBuilder() .setName(String.format("projects/%s/locations/global/keys/%s", projectId, keyId)) // Set the restriction(s). // For more information on API key restriction, see: // https://cloud.google.com/docs/authentication/api-keys .setRestrictions(restrictions) .build(); // Initialize request and set arguments. UpdateKeyRequest updateKeyRequest = UpdateKeyRequest.newBuilder() .setKey(key) .setUpdateMask(FieldMask.newBuilder().addPaths("restrictions").build()) .build(); // Make the request and wait for the operation to complete. Key result = apiKeysClient.updateKeyAsync(updateKeyRequest).get(3, TimeUnit.MINUTES); // For authenticating with the API key, use the value in "result.getKeyString()". System.out.printf("Successfully updated the API key: %s", result.getName()); } } } ``` ### Python To run this sample, you must install the [API Keys client library](https://docs.cloud.google.com/python/docs/reference/apikeys/latest). ``` from google.cloud import api_keys_v2 from google.cloud.api_keys_v2 import Key def restrict_api_key_ios(project_id: str, key_id: str) -> Key: """ Restricts an API key. You can restrict usage of an API key to specific iOS apps by providing the bundle ID of each app. TODO(Developer): Replace the variables before running this sample. Args: project_id: Google Cloud project id. key_id: ID of the key to restrict. This ID is auto-created during key creation. This is different from the key string. To obtain the key_id, you can also use the lookup api: client.lookup_key() Returns: response: Returns the updated API Key. """ # Create the API Keys client. client = api_keys_v2.ApiKeysClient() # Restrict the API key usage by specifying the bundle ID(s) of iOS app(s) that can use the key. ios_key_restrictions = api_keys_v2.IosKeyRestrictions() ios_key_restrictions.allowed_bundle_ids = ["com.google.gmail", "com.google.drive"] # Set the API restriction. # For more information on API key restriction, see: # https://cloud.google.com/docs/authentication/api-keys restrictions = api_keys_v2.Restrictions() restrictions.ios_key_restrictions = ios_key_restrictions key = api_keys_v2.Key() key.name = f"projects/{project_id}/locations/global/keys/{key_id}" key.restrictions = restrictions # Initialize request and set arguments. request = api_keys_v2.UpdateKeyRequest() request.key = key request.update_mask = "restrictions" # Make the request and wait for the operation to complete. response = client.update_key(request=request).result() print(f"Successfully updated the API key: {response.name}") # Use response.key_string to authenticate. return response ``` ### REST 1. Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the [keys.list](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/projects.locations.keys/list) method. The ID is listed in the `uid` field of the response. Replace `PROJECT_ID` with your Google Cloud project ID or name. ``` curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/" ``` 2. Use the [keys.patch](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/projects.locations.keys/patch) method to specify the iOS apps that can use an API key. This request returns a [long-running operation](https://docs.cloud.google.com/docs/authentication/api-keys#lro); you must poll the operation to know when the operation completes and get the operation status. Replace the following values: - `ALLOWED_BUNDLE_ID`: The bundle ID of an iOS app that can use the key. You can add the information for as many apps as needed; use commas to separate the bundle IDs. You must provide all bundle IDs with the request; the bundle IDs provided replace any existing allowed applications on the key. - `PROJECT_ID`: Your Google Cloud project ID or name. - `KEY_ID`: The ID of the key that you want to restrict. ``` curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "iosKeyRestrictions": { "allowedBundleIds": [" ALLOWED_BUNDLE_ID_1 "," ALLOWED_BUNDLE_ID_2 "] } } }' \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/ KEY_ID ?updateMask=restrictions" ``` For more information about adding iOS app restrictions to a key using the REST API, see [Adding iOS restrictions](https://docs.cloud.google.com/api-keys/docs/add-restrictions-api-keys#adding_ios_restrictions) in the API Keys API documentation. ### Add API restrictions API restrictions specify which APIs can be called using the API key. Note: Before you can specify an API for an API restriction, the API must be enabled for your project. To enable an API, go to the [API dashboard](https://console.cloud.google.com/apis/dashboard). To add API restrictions, use one of the following options: ### Console 1. In the Google Cloud console, go to the Credentials page: [Go to Credentials](https://console.cloud.google.com/apis/credentials) 2. Click the name of the API key that you want to restrict. 3. In the API restrictions section, click Restrict key. 4. Select all APIs that your API key will be used to access. 5. Click Save to save your changes and return to the API key list. ### gcloud 1. Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the [`gcloud services api-keys list` command](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/list) to list the keys in your project. 2. Use the [`gcloud services api-keys update` command](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/update) to specify which services an API key can be used to access. Replace the following values: - `KEY_ID`: The ID of the key that you want to restrict. - `SERVICE_1`, `SERVICE_2`...: The service names of the APIs that the key can be used to access. You must provide all service names with the update command; the service names provided replace any existing services on the key. You can find the service name by searching for the API on the [API dashboard](https://console.cloud.google.com/apis/dashboard). Service names are strings like `bigquery.googleapis.com`. ``` gcloud services api-keys update KEY_ID \ --api-target=service=SERVICE_1 --api-target=service=SERVICE_2 ``` ### Java To run this sample, you must install the [`google-cloud-apikeys` client library](https://docs.cloud.google.com/java/docs/reference/google-cloud-apikeys/latest/overview). ``` import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.ApiTarget; import com.google.api.apikeys.v2.Key; import com.google.api.apikeys.v2.Restrictions; import com.google.api.apikeys.v2.UpdateKeyRequest; import com.google.protobuf.FieldMask; import java.io.IOException; import java.util.concurrent.ExecutionException; import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; public class RestrictApiKeyApi { public static void main(String[] args) throws IOException, ExecutionException, InterruptedException, TimeoutException { // TODO(Developer): Before running this sample, // 1. Replace the variable(s) below. String projectId = "GOOGLE_CLOUD_PROJECT_ID"; // ID of the key to restrict. This ID is auto-created during key creation. // This is different from the key string. To obtain the key_id, // you can also use the lookup api: client.lookupKey() String keyId = "key_id"; restrictApiKeyApi(projectId, keyId); } // Restricts an API key. Restrictions specify which APIs can be called using the API key. public static void restrictApiKeyApi(String projectId, String keyId) throws IOException, ExecutionException, InterruptedException, TimeoutException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. After completing all of your requests, call // the `apiKeysClient.close()` method on the client to safely // clean up any remaining background resources. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { // Restrict the API key usage by specifying the target service and methods. // The API key can only be used to authenticate the specified methods in the service. Restrictions restrictions = Restrictions.newBuilder() .addApiTargets(ApiTarget.newBuilder() .setService("translate.googleapis.com") .addMethods("translate.googleapis.com.TranslateText") .build()) .build(); Key key = Key.newBuilder() .setName(String.format("projects/%s/locations/global/keys/%s", projectId, keyId)) // Set the restriction(s). // For more information on API key restriction, see: // https://cloud.google.com/docs/authentication/api-keys .setRestrictions(restrictions) .build(); // Initialize request and set arguments. UpdateKeyRequest updateKeyRequest = UpdateKeyRequest.newBuilder() .setKey(key) .setUpdateMask(FieldMask.newBuilder().addPaths("restrictions").build()) .build(); // Make the request and wait for the operation to complete. Key result = apiKeysClient.updateKeyAsync(updateKeyRequest).get(3, TimeUnit.MINUTES); // For authenticating with the API key, use the value in "result.getKeyString()". System.out.printf("Successfully updated the API key: %s", result.getName()); } } } ``` ### Python To run this sample, you must install the [API Keys client library](https://docs.cloud.google.com/python/docs/reference/apikeys/latest). ``` from google.cloud import api_keys_v2 from google.cloud.api_keys_v2 import Key def restrict_api_key_api(project_id: str, key_id: str) -> Key: """ Restricts an API key. Restrictions specify which APIs can be called using the API key. TODO(Developer): Replace the variables before running the sample. Args: project_id: Google Cloud project id. key_id: ID of the key to restrict. This ID is auto-created during key creation. This is different from the key string. To obtain the key_id, you can also use the lookup api: client.lookup_key() Returns: response: Returns the updated API Key. """ # Create the API Keys client. client = api_keys_v2.ApiKeysClient() # Restrict the API key usage by specifying the target service and methods. # The API key can only be used to authenticate the specified methods in the service. api_target = api_keys_v2.ApiTarget() api_target.service = "translate.googleapis.com" api_target.methods = ["transate.googleapis.com.TranslateText"] # Set the API restriction(s). # For more information on API key restriction, see: # https://cloud.google.com/docs/authentication/api-keys restrictions = api_keys_v2.Restrictions() restrictions.api_targets = [api_target] key = api_keys_v2.Key() key.name = f"projects/{project_id}/locations/global/keys/{key_id}" key.restrictions = restrictions # Initialize request and set arguments. request = api_keys_v2.UpdateKeyRequest() request.key = key request.update_mask = "restrictions" # Make the request and wait for the operation to complete. response = client.update_key(request=request).result() print(f"Successfully updated the API key: {response.name}") # Use response.key_string to authenticate. return response ``` ### REST 1. Get the ID of the key that you want to restrict. The ID is not the same as the display name or the key string. You can get the ID by using the [keys.list](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/projects.locations.keys/list) method. The ID is listed in the `uid` field of the response. Replace `PROJECT_ID` with your Google Cloud project ID or name. ``` curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/" ``` 2. Use the [keys.patch](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/projects.locations.keys/patch) method to specify which services an API key can be used to access. This request returns a [long-running operation](https://docs.cloud.google.com/docs/authentication/api-keys#lro); you must poll the operation to know when the operation completes and get the operation status. Replace the following values: - `SERVICE_1`, `SERVICE_2`...: The service names of the APIs that the key can be used to access. You must provide all service names with the request; the service names provided replace any existing services on the key. You can find the service name by searching for the API on the [API dashboard](https://console.cloud.google.com/apis/dashboard). Service names are strings like `bigquery.googleapis.com`. - `PROJECT_ID`: Your Google Cloud project ID or name. - `KEY_ID`: The ID of the key that you want to restrict. ``` curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ --data '{ "restrictions" : { "apiTargets": [ { "service": " SERVICE_1 " }, { "service" : " SERVICE_2 " }, ] } }' \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/ KEY_ID ?updateMask=restrictions" ``` For more information about adding API restrictions to a key using the REST API, see [Adding API restrictions](https://docs.cloud.google.com/api-keys/docs/add-restrictions-api-keys#add-api-restrictions) in the API Keys API documentation. ## Get project information from a key string You can determine which Google Cloud project an API key is associated with from its string. Replace `KEY_STRING` with the key string you need project information for. ### gcloud You use the [`gcloud services api-keys lookup` command](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/lookup) to get the project ID from a key string. ``` gcloud services api-keys lookup KEY_STRING ``` ### Java To run this sample, you must install the [`google-cloud-apikeys` client library](https://docs.cloud.google.com/java/docs/reference/google-cloud-apikeys/latest/overview). ``` import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.LookupKeyRequest; import com.google.api.apikeys.v2.LookupKeyResponse; import java.io.IOException; public class LookupApiKey { public static void main(String[] args) throws IOException { // TODO(Developer): Before running this sample, // 1. Replace the variable(s) below. // 2. Set up ADC as described in https://cloud.google.com/docs/authentication/external/set-up-adc // 3. Make sure you have the necessary permission to view API keys. // API key string to retrieve the API key name. String apiKeyString = "API_KEY_STRING"; lookupApiKey(apiKeyString); } // Retrieves name (full path) of an API key using the API key string. public static void lookupApiKey(String apiKeyString) throws IOException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. After completing all of your requests, call // the `apiKeysClient.close()` method on the client to safely // clean up any remaining background resources. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { // Initialize the lookup request and set the API key string. LookupKeyRequest lookupKeyRequest = LookupKeyRequest.newBuilder() .setKeyString(apiKeyString) .build(); // Make the request and obtain the response. LookupKeyResponse response = apiKeysClient.lookupKey(lookupKeyRequest); System.out.printf("Successfully retrieved the API key name: %s", response.getName()); } } } ``` ### Python To run this sample, you must install the [API Keys client library](https://docs.cloud.google.com/python/docs/reference/apikeys/latest). ``` from google.cloud import api_keys_v2 def lookup_api_key(api_key_string: str) -> None: """ Retrieves name (full path) of an API key using the API key string. TODO(Developer): 1. Before running this sample, set up ADC as described in https://cloud.google.com/docs/authentication/external/set-up-adc 2. Make sure you have the necessary permission to view API keys. Args: api_key_string: API key string to retrieve the API key name. """ # Create the API Keys client. client = api_keys_v2.ApiKeysClient() # Initialize the lookup request and set the API key string. lookup_key_request = api_keys_v2.LookupKeyRequest( key_string=api_key_string, # Optionally, you can also set the etag (version). # etag=etag, ) # Make the request and obtain the response. lookup_key_response = client.lookup_key(lookup_key_request) print(f"Successfully retrieved the API key name: {lookup_key_response.name}") ``` ### REST You use the [`lookupKey` method](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/keys/lookupKey) to get the project ID from a key string. ``` curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ "https://apikeys.googleapis.com/v2/keys:lookupKey?keyString= KEY_STRING " ``` ## Create a copy of an API key If you need a new API key with the same restrictions as an existing API key, you can create a copy of the existing API key. This operation creates a new API key with a unique key string and ID, with the existing API key's restrictions. The copy operation is available only in the Google Cloud console. To use other methods, follow the steps to [create an API key](https://docs.cloud.google.com/docs/authentication/api-keys#create), and then [apply the same API key restrictions](https://docs.cloud.google.com/docs/authentication/api-keys#adding-api-restrictions) to the newly generated API key. 1. In the Google Cloud console, go to the Credentials page: [Go to Credentials](https://console.cloud.google.com/apis/credentials) 2. Click the name of the API key that you want to copy. The API key's details page opens. 3. Click Create a copy. 4. Enter a name for the new API key and confirm that the restrictions are correct. 5. Click Create. ## Rotate an API key By periodically rotating your API keys, you can limit the impact of any compromised API keys. When you rotate an API key, you create a new key with the same restrictions as the old key, and update your applications to use the new key. After all of your applications are updated, you delete the old key. The rotation operation is available only in the Google Cloud console. To use other methods, follow the steps to [create an API key](https://docs.cloud.google.com/docs/authentication/api-keys#create), and then [apply the same API key restrictions](https://docs.cloud.google.com/docs/authentication/api-keys#adding-api-restrictions) to the newly generated API key. After updating your applications to use the new key, you delete the old key. 1. In the Google Cloud console, go to the Credentials page: [Go to Credentials](https://console.cloud.google.com/apis/credentials) 2. Click the name of the API key that you want to rotate to open its details page. 3. Click Rotate key. 4. Enter a name for the new API key and confirm that the restrictions are correct. 5. Click Create. 6. Copy the key string and update your applications to use the new string. 7. After you have updated all applications to use the new key, return to the details page for the new key. In the Previous key section, click Delete the previous key to delete the old key. If you find that you deleted the old key prematurely, you can [undelete it](https://docs.cloud.google.com/docs/authentication/api-keys#undelete). ## Undelete an API key If you delete an API key by mistake, you can undelete (restore) that key within 30 days of deleting the key. After 30 days, you cannot undelete the API key. ### Console 1. In the Google Cloud console, go to the Credentials page: [Go to Credentials](https://console.cloud.google.com/apis/credentials) 2. Click Restore deleted credentials. 3. Find the deleted API key that you want to undelete, and click Restore. Undeleting an API key may take a few minutes to propagate. After propagation, the undeleted API key is displayed in the API keys list. ### gcloud 1. Get the ID of the key that you want to undelete. The ID is not the same as the display name or the key string. You can get the ID by using the [`gcloud services api-keys list --show-deleted` command](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/list) to list the deleted keys in your project. 2. Use the [`gcloud services api-keys undelete` command](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/undelete) to undelete an API key. ``` gcloud services api-keys undelete KEY_ID ``` Replace the following values: - `KEY_ID`: The ID of the key that you want to undelete. ### Java To run this sample, you must install the [`google-cloud-apikeys` client library](https://docs.cloud.google.com/java/docs/reference/google-cloud-apikeys/latest/overview). ``` import com.google.api.apikeys.v2.ApiKeysClient; import com.google.api.apikeys.v2.Key; import com.google.api.apikeys.v2.UndeleteKeyRequest; import java.io.IOException; import java.util.concurrent.ExecutionException; import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; public class UndeleteApiKey { public static void main(String[] args) throws IOException, ExecutionException, InterruptedException, TimeoutException { // TODO(developer): Replace these variables before running the sample. // Project ID or project number of the Google Cloud project. String projectId = "YOUR_PROJECT_ID"; // The API key id to undelete. String keyId = "YOUR_KEY_ID"; undeleteApiKey(projectId, keyId); } // Undeletes an API key. public static void undeleteApiKey(String projectId, String keyId) throws IOException, ExecutionException, InterruptedException, TimeoutException { // Initialize client that will be used to send requests. This client only needs to be created // once, and can be reused for multiple requests. try (ApiKeysClient apiKeysClient = ApiKeysClient.create()) { // Initialize the undelete request and set the argument. UndeleteKeyRequest undeleteKeyRequest = UndeleteKeyRequest.newBuilder() .setName(String.format("projects/%s/locations/global/keys/%s", projectId, keyId)) .build(); // Make the request and wait for the operation to complete. Key undeletedKey = apiKeysClient.undeleteKeyAsync(undeleteKeyRequest) .get(3, TimeUnit.MINUTES); System.out.printf("Successfully undeleted the API key: %s", undeletedKey.getName()); } } } ``` ### REST 1. Get the ID of the key that you want to undelete. The ID is not the same as the display name or the key string. You can get the ID by using the [keys.list](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/projects.locations.keys/list) method, with the `showDeleted` query parameter set to `true`. The key ID is listed in the `uid` field of the response. Replace `PROJECT_ID` with your Google Cloud project ID or name. ``` curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys?showDeleted=true" ``` 2. Use the [undelete](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/projects.locations.keys/undelete) method to undelete the API key. ``` curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ "https://apikeys.googleapis.com/v2/projects/ PROJECT_ID /locations/global/keys/ KEY_ID :undelete" ``` This request returns a [long-running operation](https://docs.cloud.google.com/docs/authentication/api-keys#lro); you must poll the operation to know when the operation completes and get the operation status. Replace the following values: - `PROJECT_ID`: Your Google Cloud project ID or name. - `KEY_ID`: The ID of the key that you want to restrict. ## Determine the API key type You can determine whether the API key is bound to a service account by inspecting the key. ### Console 1. In the Google Cloud console, go to the Credentials page: [Go to Credentials](https://console.cloud.google.com/apis/credentials) If the API key is bound to a service account, the service account identifier is displayed. ### gcloud 1. Get the ID of the key. The ID is not the same as the display name or the key string. You can get the ID by using the [`gcloud services api-keys list` command](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/list) to list the keys in your project. 2. Use the [`gcloud services api-keys describe` command](https://docs.cloud.google.com/sdk/gcloud/reference/services/api-keys/describe) to describe the API key. ``` gcloud services api-keys describe KEY_ID ``` If the API key is bound to a service account, the `serviceAccountEmail` field is displayed. ## Poll long-running operations API Keys API methods use long-running operations. If you use the REST API to create and manage API keys, an operation object is returned from the initial method request. You use the operation name to poll the long-running operation. When the long-running request completes, polling the operation returns the data from the long-running request. To poll a long-running API Keys API operation, you use the [`operations.get`](https://docs.cloud.google.com/api-keys/docs/reference/rest/v2/operations/get) method. Replace `OPERATION_NAME` with the operation name returned by the long-running operation. For example, `operations/akmf.p7-358517206116-cd10a88a-7740-4403-a8fd-979f3bd7fe1c`. ``` curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json; charset=utf-8" \ "https://apikeys.googleapis.com/v2/ OPERATION_NAME " ``` ## Limits on API keys You can create up to 300 API keys per project. This limit is a system limit, and can't be changed using a quota increase request. If more API keys are needed, you must use more than one project. You can add up to 1200 [application restrictions](https://docs.cloud.google.com/docs/authentication/api-keys#adding-application-restrictions) to an API key. ## What's next - Learn about [best practices for keeping your API keys secure](https://docs.cloud.google.com/docs/authentication/api-keys-best-practices). - Learn more about the [API Keys API](https://docs.cloud.google.com/api-keys/docs/overview). Send feedback Except as otherwise noted, the content of this page is licensed under the [Creative Commons Attribution 4.0 License](https://creativecommons.org/licenses/by/4.0/), and code samples are licensed under the [Apache 2.0 License](https://www.apache.org/licenses/LICENSE-2.0). For details, see the [Google Developers Site Policies](https://developers.google.com/site-policies). Java is a registered trademark of Oracle and/or its affiliates. Last updated 2025-10-16 UTC. Need to tell us more? \[\[\["Easy to understand","easyToUnderstand","thumb-up"\],\["Solved my problem","solvedMyProblem","thumb-up"\],\["Other","otherUp","thumb-up"\]\],\[\["Hard to understand","hardToUnderstand","thumb-down"\],\["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"\],\["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"\],\["Other","otherDown","thumb-down"\]\],\["Last updated 2025-10-16 UTC."\],\[\],\[\]\] - ### Products and pricing - [See all products](https://cloud.google.com/products/) - [Google Cloud pricing](https://cloud.google.com/pricing/) - [Google Cloud Marketplace](https://cloud.google.com/marketplace/) - [Contact sales](https://cloud.google.com/contact/) - ### Support - [Google Cloud Community](https://www.googlecloudcommunity.com/) - [Support](https://cloud.google.com/support-hub/) - [Release Notes](https://cloud.google.com/release-notes) - [System status](https://status.cloud.google.com/) - ### Resources - [GitHub](https://github.com/googlecloudPlatform/) - [Getting Started with Google Cloud](https://docs.cloud.google.com/docs/get-started/) - [Code samples](https://docs.cloud.google.com/docs/samples) - [Cloud Architecture Center](https://docs.cloud.google.com/architecture/) - [Training and Certification](https://cloud.google.com/learn/training/) - ### Engage - [Blog](https://cloud.google.com/blog/) - [Events](https://cloud.google.com/events/) - [X (Twitter)](https://x.com/googlecloud) - [Google Cloud on YouTube](https://www.youtube.com/googlecloud) - [Google Cloud Tech on YouTube](https://www.youtube.com/googlecloudplatform) - [About Google](https://about.google/) - [Privacy](https://policies.google.com/privacy) - [Site terms](https://policies.google.com/terms?hl=en) - [Google Cloud terms](https://docs.cloud.google.com/product-terms/) - [Manage cookies](https://docs.cloud.google.com/docs/authentication/api-keys) - [Our third decade of climate action: join us](https://cloud.google.com/sustainability) - Sign up for the Google Cloud newsletter [Subscribe](https://cloud.google.com/newsletter/) - [English]() - [Deutsch]() - [Español]() - [Español – América Latina]() - [Français]() - [Indonesia]() - [Italiano]() - [Português]() - [Português – Brasil]() - [中文 – 简体]() - [中文 – 繁體]() - [日本語]() - [한국어]()
Readable Markdown	null
Shard	95 (laksa)
Root Hash	744624608793826895
Unparsed URL	com,google!cloud,docs,/docs/authentication/api-keys s443