We have a client looking to have a complex map module created, but they are only on CMS Pro and do not have access to serverless functions. Is there a way to secure the Google Map API Key if we don’t have access to Serverless function?
For more details, the map module needs to pinpoint available property locations and have a popup with more info on the property when you click on the pin. All the info also needs to feed into a HubDB table to allow the filtering of the properties.
How would you handle this?
Just out of curiosity, what is the point of a serverless function in this use case? Isn’t the Google Maps API key meant to be exposed on the front end and Google Console’s security restricts it to predefined URLs?
The serverless function in HubSpot helps to hide the key.
Early last year, I have tried to use the Google Map restrict key option but was kind of incompatible with HubSpot. If HubSpot or anyone should share some thought or example if they have done something similar securing the Google API key without using the Serverless function. That will be helpful.
That doesn’t make sense to me since the Google Maps code contains a key in the javascript that is meant to be exposed in the frontend code correct?
Problem 1
Yes, it is correct Google provides a way to expose the key and restrict per domain or hide your key in your server. My previous client wasn’t comfortable exposing their key for the reason discussed here https://stackoverflow.com/questions/38153734/do-i-need-to-hide-api-key-when-using-google-maps-js-api-if-so-how
Problem 2 (DNS Server, HubSpot, Google)
When we tried to restrict the key ourselves it didn’t work because Google for some reason was having conflict pointing between our DNS server and HubSpot. So the client had to get help from the Google Support team to set up the API Key restrictions properly for us so that it can work in HubSpot.
Back to Problem 1
I think restricting the API Key to the domain URL will be the option even though is 90% safe unless to use the Serverless function or other server means to the key completely.
I have the exact same issue as Problem 2.
No matter how I attempt to restrict the key in Google using HTTP referrers or IP address(es) it simply will not allow a request from HubSpot. The only way the API call succeeds is if I remove all restrictions and then it works just fine.
Since I can’t use a serverless function to secure the key and I can’t restrict access on Google’s end I am completely stuck.
Please let me know if you found a solution to this.
Google’s recommendations are now to not expose the key
I have been trying to implement Google Maps integration as well, but information out there is scarce. I was wondering how would I secure the Google Maps API key without a serverless function. We don’t have Enterprise.
