title: Odd responses using Google Maps Geocode Lookup (API key)
body: <p>I've been working with website that uses geocode lookups via Google. I've been testing this for awhile now.</p>
  
  <pre><code>https://maps.googleapis.com/maps/api/geocode/json?address=1600+Pennsylvania+Ave+NW,+Washington,+DC&amp;key=XXXXXXXXXXXXXXXXXXXXXXXXXXX
  </code></pre>
  
  <p>I've got that key locked to particular servers.  All of a sudden I'm seeing geocode lookup errors.  The response back from Google is:</p>
  
  <pre><code>{
      error_message: "Browser API keys cannot have referer restrictions when used with this API.",
      results: [ ],
      status: "REQUEST_DENIED"
  }
  </code></pre>
  
  <p>When I try a simple request without the API key at all it seems to work fine. Here you can try this yourself.  Copy and paste the next line in your browser's URL and return.</p>
  
  <pre><code>https://maps.googleapis.com/maps/api/geocode/json?address=1600+Pennsylvania+Ave+NW,+Washington,+DC
  </code></pre>
  
  <p>Now, I probably shouldn't look a gift horse in the mouth, but the whole thing seems odd.  If I remove my API keys today, will my websites, that rely on an address to Lat/Lng conversion, all fail tomorrow?</p>
  
  <p>Is anybody else experiencing odd failures with Google Maps and GeoCode lookups?  Is anyone aware of a systemic content or policy change from the Google mapping / GeoCoding team??</p>
  
  <p>Edit, update:
  So this defect lasted about 40 minutes, from around 9:10PM PST until a bit before 10PM PST.  It seems to be fixed now.  </p>
  
  <p>Response to comment:  Hmmm.  I've been looking at the API keys as:</p>
  
  <blockquote>
    <p>Server keys: Create and use a Server key if your application runs on a
    server. Do not use this key outside of your server code. For example,
    do not embed it in a web page. To prevent quota theft, restrict your
    key so that requests are only allowed from your servers' source IP
    addresses.</p>
    
    <p>Browser keys: Create and use a Browser key if your application runs on
    a client, such as a web browser. To prevent your key from being used
    on unauthorized sites, only allow referrals from domains you
    administer.</p>
  </blockquote>
  
  <p>I'm definitely doing this complete lookup from user directly to Google without a server in the middle.  No way can I safely use a Server key there.  So I've read your input, and it definitely says Server key for geocoding.  But, that really implies that no one should ever allow a browser / client interaction to process a geocode lookup. Frankly I just assumed the writeup was out of date and a bit inaccurate. </p>
  
  <p>While you may be right, the whole thing just looks odd.  I would have thought that if Geocode required a lookup from a server (only) and never from a web application via the browser (ever) that there would have been some direct comment as to that effect.  </p>
  
  <p>Oh, and the browser keys, with server fencing, seem to be working again.  Again, I'm just saying the whole thing is odd.  I'm treating this as a temporary hiccup up at the Google geocode servers. </p>
  
  <p>And yes, I can certainly introduce an API server for a round trip Ajax call to do the lookup safely with a server key, but what's the point? Is there a benefit that I'm just not seeing? I guess I could add elements like a nonce to protect my round trip geocode intermediate lookup server from somebody else using it, etc....  But at this point, I'm just confused.  </p>
  
  <p>Update #2:  16 Jun 2016
  Again, this whole thing is not clear.  I filed a <a href="https://code.google.com/p/gmaps-api-issues/issues/detail?id=9954" rel="nofollow">feature request to the Google GeoCode team</a> asking for a clarification update to the documentation to address the use of Browser API keys for geocode lookups.</p>