To get a Google Maps API key, create a Google Cloud project with billing enabled, enable the Maps APIs you need, then create a key under APIs & Services > Credentials and restrict it. A Google Maps API key is the string that identifies your project to Google, meters your usage and bills anything above the free monthly allowance.
The short answer
- The key is free, and each SKU has free monthly calls. New customers also get a $300 trial credit, per Google's pricing page.
- Billing must be enabled. Google's setup guide says to create a billing-enabled Cloud project before you start.
- Restrict the key twice: by website and by API. Do this before the site goes live.
- Most errors name themselves in the browser console (
BillingNotEnabledMapError,RefererNotAllowedMapErrorand so on); the fixes are below. - If you use StoreRocket, you will need a key of your own after the free trial. During the trial StoreRocket supplies the map. After you subscribe you connect your own Google Maps or Mapbox key and pay that provider directly.
What Is a Google Maps API Key?
An API key is a credential that accompanies every request your site makes to Google Maps Platform — map loads, geocoding lookups, place searches. Google uses it to know which project to meter, which APIs you're allowed to call, and where to send the bill above the free monthly caps.
One key can serve multiple APIs, and one project can hold multiple keys. The best practice is one key per application (your website, your iOS app, your Android app), each locked to that platform.
Related: Google Maps API pricing | How to use Google Maps API free | Google Maps vs Mapbox | How to add a Google Maps store locator | Set the Google Maps region
Before You Start: What You'll Need
- A Google account.
- A billing-enabled Cloud project. Google says you must create one to start using Google Maps Platform. You won't necessarily pay anything when free monthly usage covers your traffic.
- Access to the Google Cloud Console.
Worried about costs? The short version: free monthly usage varies by SKU. Dynamic Maps includes 10,000 free monthly loads, then its first paid band is $7.00 per 1,000. Full breakdown with examples in our Google Maps API pricing guide.
Step 1: Create a Google Cloud Project
- Go to console.cloud.google.com and sign in.
- Open the project picker in the top bar and click New project.
- Name it something recognizable ("mysite-maps"), pick your billing account, and create it.
- Make sure the new project is selected in the picker before continuing — a surprising number of "my key doesn't work" cases are keys created in the wrong project.
Step 2: Enable the APIs You Need
A key only works for APIs that are enabled on its project. From the console menu, go to APIs & Services → Enable APIs and services (the API Library) and enable what your site actually uses:
| API | Enable it if you need… |
|---|---|
| Maps JavaScript API | An interactive map on a web page (this is the big one) |
| Geocoding API | Converting addresses to coordinates and back |
| Places API | Address autocomplete, business details, place search |
| Maps Static API | Non-interactive map images |
| Routes API | Route calculation and matrices |
| Directions API (Legacy) | Existing integrations that have not migrated to Routes |
For a typical store locator: Maps JavaScript API + Geocoding API, plus Places API if you offer address autocomplete in the search box.
Step 3: Create the API Key
- In the console menu, go to APIs & Services → Credentials.
- Click Create credentials and choose API key.
- The key is generated instantly — a string starting with
AIza….
Don't close the dialog and walk away: an unrestricted key is a liability. Anyone who finds it in your page source can run their usage on your bill. Restrict it now.
Step 4: Restrict Your Key (Don't Skip This)
Keys have two independent restriction layers — Google's best practice is to set both:
Application restrictions — who can use the key
On the key's settings page, under Application restrictions, choose Websites (older docs and tutorials call this "HTTP referrers (web sites)" — same setting). Add your site's referrers, including the scheme:
1https://example.com
2https://example.com/*
3https://*.example.com
The wildcard subdomain entry covers www. and any other subdomains. For native apps, use the Android apps or iOS apps restriction instead — and give each platform its own key.
API restrictions — what the key can call
Under API restrictions, choose Restrict key, then Select APIs and tick only the APIs from Step 2. If the key leaks, it can't be used to run up charges on APIs you never intended to expose.
Save, and give changes a few minutes to propagate.
Step 5: Add the Key to Your Site
For the Maps JavaScript API, the key rides along in the script URL:
1<script async
2 src="https://maps.googleapis.com/maps/api/js?key=YOUR_API_KEY&callback=initMap">
3</script>
For server-side calls like geocoding, use a separate server key restricted to the server's IP address and only the APIs it needs. Pass that key as a query parameter:
1https://maps.googleapis.com/maps/api/geocode/json?address=1600+Amphitheatre+Parkway&key=YOUR_SERVER_API_KEY
Your browser key is visible in page source — that's expected for client-side maps. The referrer restriction from Step 4 is what limits where it works. Keep server keys out of browser code and public repositories.
Where to Find an Existing API Key
Inherited a project and need to know what your API key is? Go to console.cloud.google.com → APIs & Services → Credentials (with the right project selected in the picker). Every key in the project is listed there — you can view it, see its restrictions, check which APIs it may call, and regenerate it if it's been exposed.
Fixing Common API Key Errors
The classic symptom: your map renders greyed-out with a "for development purposes only" watermark, and visitors see an alert saying "This page can't load Google Maps correctly." That message is generic — the real error is printed in the browser's developer console as a specific code:
| Console error | What's wrong | Fix |
|---|---|---|
BillingNotEnabledMapError |
No billing account on the project | Enable billing (Console → Billing) and link the project |
ApiNotActivatedMapError |
The API you're calling isn't enabled | Enable it in APIs & Services → Library (Step 2) |
RefererNotAllowedMapError |
Your page's URL isn't in the key's allowed referrers | Add the URL (with scheme, and a /* path wildcard) to the Websites restriction |
InvalidKeyMapError |
The key in your script tag doesn't exist | Re-copy the key from Credentials; check for truncation or the wrong project |
Open DevTools (F12) → Console, find the *MapError code, apply the matching fix, and allow a few minutes for restriction changes to propagate.
Key Security Habits Worth Keeping
- One key per platform — web, iOS, Android each get their own, restricted accordingly.
- Separate keys for dev and production — so localhost testing never has to loosen your production restrictions.
- Regenerate if exposed — if a key ever ships unrestricted or lands in a public repo, regenerate it in Credentials and update your site.
- Watch usage — the console's APIs & Services dashboard shows per-API traffic, so a scraped or abused key shows up as a traffic spike.
- Set quotas — Google Maps Platform has no automatic spending cap, and budget alerts only notify you. Per-API quotas in the console are the hard limit. See Google Maps API pricing.
The Store Locator Shortcut
We make StoreRocket, so weigh our view with that in mind. If the reason you need a key is a store locator, StoreRocket provides the search, filters, clustering, directions and location dashboard around the map. Imports place each address on the map for you. During the free trial StoreRocket supplies the map. After you subscribe you connect your own Google Maps or Mapbox key, so the steps above are the ones you follow. Analytics depends on the plan; see pricing. If you would rather build the locator yourself, our guide lists what it needs.
StoreRocket gives businesses with several locations a store locator for their own website: import your locations from a spreadsheet, match it to your brand and paste one embed code. Create your locator with a free trial, no credit card needed.
Frequently Asked Questions
Is a Google Maps API key free?
The key itself is free, and free monthly usage varies by SKU. Dynamic Maps includes 10,000 free monthly loads, then its first paid band is $7.00 per 1,000. Google says you must create a billing-enabled Cloud project to start, even if usage stays within the free allowance. See our full pricing breakdown.
Do I need a credit card to get a Google Maps API key?
The project needs a billing account. Google's setup guide does not say which payment methods it accepts, and new customers get a $300 trial credit, so check the options for your country when you set up billing.
Can I use Google Maps on my website without an API key?
Not for the interactive JavaScript map — API requests without a valid key fail. The exception is a basic Google Maps embed iframe (the "Share → Embed a map" snippet from google.com/maps), which works keyless but gives you a fixed map with no search or styling. A Google My Maps embed can show several pins the same way.
How do I find my existing Google Maps API key?
In the Google Cloud Console: select the right project in the top project picker, then go to APIs & Services → Credentials. All API keys for the project are listed there, along with their restrictions.
Why does my map say "for development purposes only"?
That watermark, along with the "This page can't load Google Maps correctly" alert, means your key has a configuration problem — most often billing not enabled on the project. Open the browser console to find the specific code (BillingNotEnabledMapError, ApiNotActivatedMapError, RefererNotAllowedMapError, or InvalidKeyMapError) and fix that underlying issue.
How should I restrict my Google Maps API key?
Apply both layers: an application restriction (choose "Websites" and list your domains with scheme and wildcards, e.g. https://*.example.com) and an API restriction (Restrict key → select only the APIs you actually use). Together they make a leaked key nearly useless to anyone else.
How many API keys do I need?
One per application platform is the best practice: one for your website (referrer-restricted), one per mobile app (app-restricted), and ideally separate dev and production keys. All of them can live in the same Cloud project and share its free tier and billing.
Does one API key work for multiple APIs?
Yes — a single key can call every API enabled on its project, and you control the exact list via API restrictions. What's billed is the usage per API, not the number of keys.