0

I developed the WordPress plugin WP Google Fonts v3.1.1, which uses the Google Fonts API to download the entire list of fonts available from Google upon first use and then no more than once every 12 hours after that, based on visiting the admin panel page. I kept the API key in the code because it is a public key and used by Google for tracking and limiting usage.

    var $api_key = '?key=[the key I am trying to leave out]';

    var $api_url = 'https://www.googleapis.com/webfonts/v1/webfonts';

I was aware that others would have access to the key and potentially reuse it in their own variations of the plugin, but didn't foresee hitting the usage limits even so.

Since then, the plugin became fairly popular, which increased the number of calls.

Also, a few theme developers have included the API key and other snippets of the code in their own variations, additionally increasing usage on the key.

This has led to frequent usage limiting. Roughly half the calls on any given day are being denied due to overage.

The key is intended for use on any domain, so I can't limit by referral source as some solutions recommend.

Because it is a WordPress plugin, it is open source by nature so any developer can quickly find the key, even if it's in a configuration file.

I want to keep the plugin as easy to use as possible, so I don't like the idea of individuals having to get their own key and enter it in a settings panel.

What are my options to keep the API key out of the source code?

I've read solutions that say either this simply can't be avoided, or that I should create a proxy web service as an intermediate layer, which I'm not sure would solve this situation.

1
  • Thanks for the reminder @humble.rumble. I've given the link to the source code and added the section of code that I'd like to see changed.
    – Web Malama
    May 26, 2015 at 1:15

1 Answer 1

3

You have no option you will have to instruct your users how to create there own API key. You cant release a PHP WordPress plugin with an API Key you created.

Changes to the Google APIs Terms of Service states

Asking developers to make reasonable efforts to keep their private keys private and not embed them in open source projects.

If the key is visible to your users in the code you must instruct them how to create there own key you can not share yours. If you do your Google Developer console account can be revoked. read this here

1
  • Thank you @DalmTo, your answer helps. I'll start thinking through the best way to make this change.
    – Web Malama
    May 26, 2015 at 16:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.