Google Cloud Compliance ControlsGoogle Cloud API Keys
API keys should allow use only by specified hosts and apps
Unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API key usage to trusted hosts, HTTP referrers and apps.
What this control checks
API keys must be restricted to use by only specified Hosts and Apps.
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-03
- PR.AA-05
- 1.13 Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps
- 1.13 Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps
- 1.13 Ensure API keys are restricted to use by only specified Hosts and Apps
- 1.13 Ensure API keys are restricted to use by only specified Hosts and Apps
- 1.13 Ensure API keys are restricted to use by only specified Hosts and Apps
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_api_key_restricts_websites_hosts_apps - Powerpipe Control:
gcp_compliance.control.iam_api_key_restricts_websites_hosts_apps
Last reviewed: 2026-10-09