Comment by boredpudding

Google API keys have been used for ages on the frontend. For example on Google Maps embeds. Those are not possible without exposing a key to the frontend. They weren't secret, until Gemini arrived.

https://trufflesecurity.com/blog/google-api-keys-werent-secr...

https://medium.com/@ahhyesic/your-google-maps-api-key-now-ha...

https://www.malwarebytes.com/blog/news/2026/02/public-google...