Open jaydp17 opened 7 years ago
hi, Google's API_KEY is required for API access and is subject to quotas. So if you make it public, another person can use it and mess up your service quota. So you should keep it secret.
If I understand correctly, your project consists in client-side code making calls to Google's API. So the best choice is to provide OAuth 2.0 auth. relevant link
Hey @daveseco7, thanks for the interest!
It does make sense to use OAuth. I'd really appreciate if you can send in a PR implementing it
Currently, the usage involves getting an
API_KEY
from Google, which could be too much hassle for a lot of people.Any alternate way to make it simpler?
Some of the things I've in mind
API_KEY
public and ship it with the package ( not really sure how secure it is 😨 )Your suggestions welcome ... 🙂