Digital Signature Guide

Page Summary

outlined_flag

• Digitally signing Google Maps API requests enhances security by using a unique URL signing secret to verify requests, supplementing API key usage.

• You can restrict your API key to only accept signed requests by adjusting the "Unsigned requests" quota in the Google Cloud console for the Maps Static API or Street View Static API.

• Generating a signed request involves obtaining your URL signing secret, constructing the unsigned request URL, and then using the secret to create and append the signature.

• Server-side code examples in Python and Java are provided to guide the implementation of digital signatures for dynamic requests.

• URL signing secrets should be kept confidential, and requests should use either a client ID or an API key, not both, with UTF-8 encoding enforced.

Digitally sign your request with an API key

Depending on your usage, a digital signature - in addition to an API key - may be required to authenticate requests. See the following articles:

• Maps Static API Other Usage Limits
• Street View Static API Other Usage Limits

How digital signatures work

Digital signatures are generated using a URL signing secret, which is available on the Google Cloud console. This secret is essentially a private key, only shared between you and Google, and is unique to your project.

The signing process uses an encryption algorithm to combine the URL and your shared secret. The resulting unique signature allows our servers to verify that any site generating requests using your API key is authorized to do so.

Limit unsigned requests

To ensure that your API key only accepts signed requests:

1. Go to the Google Maps Platform Quotas page in the Cloud console.
2. Click the project drop-down and select the same project you used when you created the API key for your application or site.
3. Select the Maps Static API or Street View Static API from the APIs drop-down.
4. Expand the Unsigned requests section.
5. In the Quota Name table, click the edit button next to the quota you want to edit. For example, Unsigned requests per day.
6. Update Quota limit in the Edit Quota Limit pane.
7. Select Save.

Signing your requests

Signing your requests comprises the following steps:

• Step 1: Get your URL signing secret
• Step 2: Construct an unsigned request
• Step 3: Generate the signed request

Step 1: Get your URL signing secret

To get your project URL signing secret:

1. Go to the Google Maps Platform Credentials page in the Cloud console.
2. Select the project drop-down and select the same project you used when you created the API key for the Maps Static API or Street View Static API.
3. Scroll down to the Secret Generator card. The Current secret field contains your current URL signing secret.
4. The page also features the Sign a URL now widget that allows you to automatically sign the Maps Static API or Street View Static API request using your current signing secret. Scroll down to the Sign a URL now card to access it.

To get a new URL signing secret, select Regenerate Secret. The previous secret will expire 24 hours after you've generated a new secret. After the 24 hours have passed, requests containing the old secret no longer work.

Step 2: Construct your unsigned request

Characters not listed in the table below must be URL-encoded: