# 1.13 Ensure API Keys Are Restricted to Specific Hosts and Applications (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000232915-113-ensure-api-keys-are-restricted-to-specific-hosts-and-applications-manual - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-06-16 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability:Level 2 ### Description: API keys should only be used in scenarios where alternative authentication methods are unavailable. Unrestricted API keys are insecure as they can be exposed in client-side environments or accessed on devices, making them susceptible to theft. To mitigate risks, API key usage should be restricted to trusted hosts, HTTP referrers, or specific applications. ### Rationale: The use of unrestricted API keys poses significant security risks: 1. API keys are simple encrypted strings that can be easily discovered if exposed. 2. No user or application identification is associated with API key-based requests, limiting accountability. 3. Client-side accessibility makes it easy for attackers to steal keys from browsers, devices, or logs. To reduce attack vectors, API keys should be restricted to specific and trusted hosts, IP addresses, or applications. While Google recommends using standard authentication methods over API keys, certain use cases (e.g., mobile apps) may require API keys. In such cases, applying restrictions minimizes the risks. ### Impact: Applying restrictions may disrupt existing applications if not carefully implemented. Ensure restrictions are configured to allow access only to required hosts, referrers, or apps. ### Default Value: By default, Application Restrictions are set to "None" for API keys, allowing unrestricted access. ### Remediation: Test Plan: Using Google Cloud Console: 1. Navigate to APIs & Services > Credentials: [GCP Credentials Console](https://console.cloud.google.com/apis/credentials).                                     ![](https://support.icompaas.com/assets/kb/ab4b149de9354b91.png) 2. For each API key: - Click the API Key Name to view its properties.                       ![](https://support.icompaas.com/assets/kb/266d9837ad448473.png) - Verify that the Key restrictions section under Application restrictions is not set to "None."                                    ![](https://support.icompaas.com/assets/kb/f83d00f04bd5ff0a.png) - If set to HTTP referrers, ensure no wildcards (\*, \*.\[TLD\], \*.\[TLD\]/\*) are used. - If set to IP addresses, ensure no unrestricted addresses are configured (e.g., 0.0.0.0, 0.0.0.0/0, ::0). Using Google Cloud CLI: List all API keys for the project: gcloud services api-keys list --filter="-restrictions:\*" --format="table\[box\](displayName:label='Key With No Restrictions')" 1. Ensure the output does not include any unrestricted API keys. ### Implementation: Restricting Existing API Keys (Using Google Cloud Console): 1. Go to APIs & Services > Credentials: [GCP Credentials Console](https://console.cloud.google.com/apis/credentials)                            ![](https://support.icompaas.com/assets/kb/dc0860ea786f3e66.png) 2. For each API key: - Click the API Key Name to view its properties. ![](https://support.icompaas.com/assets/kb/5db8999b20d29f26.png) - In the Key restrictions section, set restrictions to one of the following:                         ![](https://support.icompaas.com/assets/kb/868447cf8c498c45.png) - HTTP referrers: Specify trusted referrers. Avoid using wildcards like \* or \*.\[TLD\]. - IP addresses: Specify allowed IP addresses. Avoid 0.0.0.0, 0.0.0.0/0, or ::0.                                                ![](https://support.icompaas.com/assets/kb/a6d8dd9ccb00e073.png) - Android apps or iOS apps: Specify the application packages or bundle IDs.                                              ![](https://support.icompaas.com/assets/kb/d5310e88957eeca0.png) - Click Save after making changes.                                                ![](https://support.icompaas.com/assets/kb/87d9300018ed3c8f.png) 3 . Removing Unused API Keys (Using Google Cloud Console): 1. Identify unused API keys. 2. Select the checkbox next to each key and click Delete. Confirm the deletion when prompted.                      ![](https://support.icompaas.com/assets/kb/27bc3428b2bb5277.png) Using Google Cloud CLI: List API keys to identify unrestricted ones:  gcloud services api-keys list --filter="-restrictions:\*" Update the restrictions for an API key: gcloud alpha services api-keys update \\ --restrictions='type:HTTP\_REFERRER,referrers:YOUR\_TRUSTED\_REFERRERS' Delete unused keys: gcloud alpha services api-keys delete ## Backout Plan: 1\. Restore API Key Restrictions (If Necessary): If an API key needs broader access temporarily, remove restrictions: (Use with caution!) gcloud alpha services api-keys update --restrictions='type:HTTP\_REFERRER,referrers=\*' 2\. Restore IAM Policy from Backup If needed, restore a previous IAM policy: gcloud projects set-iam-policy PROJECT\_ID policy-backup.json References: 1. [Using API Keys for Authentication](https://cloud.google.com/docs/authentication/api-keys) 2. [Listing API Keys with Restrictions](https://cloud.google.com/sdk/gcloud/reference/services/api-keys/list) 3. [Updating API Key Restrictions](https://cloud.google.com/sdk/gcloud/reference/alpha/services/api-keys/update) ### CIS Controls:

Control

Description

IG 1

IG 2

IG 3

16.10 Apply Secure Design Principles

Ensure application architectures follow secure design principles, including least privilege, input validation, and minimizing attack surface.

✅

✅

❌

Explicitly Not Mapped

Not explicitly mapped in CIS v7 controls.

❌

❌

❌

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.