Google Maps APIs and key restrictions

Hi folk,
Not sure if you have ever tried to user Google Maps APIs from an Expo App.

I have components that use Google APIs, such as

  • Map Static API
  • Geocode API
  • Places API.

The problem is based on the fact that Google considers Geocode and Places APIs as Web Service APIs and only supports restricting the Google API key by IP address.

Has anyone ever restricted Google API Keys and invoked Web Service Google APIs from an Expo APP?

I know that I can use some of Expo features so I can avoid using some of the Google APIs:

  • Replace Map static API usage by MapView expo component.
  • Replace Geocode API usage by Location expo module.

Hi! I’m not familiar with those exact APIs. From what I can find:

It sounds like they intend the Geocoding API to only be used in server-side applications. How would you take advantage of a IP address-restricted API key in a non-Expo (i.e. “vanilla” Android or iOS) app?

HI @dikaiosune,

Thanks a lot for getting back.

I agree, it looks like as far as Google guys intend Geocode and Places APIs not to be invoked from front apps, as they don’t allow referer or any other sort of web restrictions for those APIs.

In fact, I can’t figure out a way to restrict the usage of the key in Expo, or any other web client for those APIs, apart from proxying the requests from my own gateway or middleware.

Not sure if someone using expo has used the places API for creating a google autocomplete, or it is using some component like react-native-google-places-autocomplete in production with restricted keys.

Look like those apis also allow restricting key based on iOS or Android module name, on using Google iOS SDK or Google Android SDK, but I have no idea if I can use those restrictions with EXPO, since this is my first time with Expo.

See example for Android:

Faced a similar issue while trying to use Places and Geocoding APIs.

The documentation specifies that these are web service requests, so I was unabled to make them work from the expo app itself.
I was able to solve this issue with moving the api requests to my backend and restricting by ip address with my server’s ip address. Upon reading more on this subject, I think this would be the only solution, since you can’t possibly enable every ip address that tries to make requests from your app.

The Android apps / iOS apps restrictions apply for other APIs, but geocoding and places will still remain web services so that still won’t help you here !

1 Like

Thanks @hisztendahl and @dikaiosune,

Looks like proxying is the only waying to go.

Interesting, since I am using Heroku (dynamic IPs) for deploying my middleware layer, but I can also use Heroku Addons for getting static IPs.

Having said that, another way to go could be setting up a proxy in EC2 and redirecting the request to Google APIs.

However, that is not related at all with Expo. :smile:

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.