API key accessible from browser

[Align-center]

Hello,
I'm currently implementing your autocomplete solution but noticed that my (and everyone else's) API key is accessible in the browser console.
I saw that options to "protect" the key are available but they can easily be bypass by forcing an origin and referer.
So my question is : Is there any way to really protect my API key from being used by anyone ?

Thanks.

[geoapify]

Yes, this is normal for browser-based maps and autocomplete solutions.

Since requests are made directly from the client, the API key must be accessible in the browser, so it can be seen in DevTools or network requests. This is the same for most map providers.

For customer-facing frontend applications, it’s unfortunately not possible to fully protect an API key when requests are made directly from the browser. The alternative is routing requests through your own backend proxy, which adds extra infrastructure, complexity, and potentially additional latency.

In practice, this is usually not a problem. We monitor API usage on our side and if we detect suspicious activity, we can block it — typically starting with narrow restrictions such as IP-based or pattern-based blocking instead of disabling the whole key immediately.

We also recommend:

• enabling domain/referrer restrictions
• monitoring usage regularly
• rotating API keys from time to time as a good security practice