i am planning to use google maps in one of appexchange apps. We need to store and retrieve the api key to be used for google maps.

The end client would have to enter the key that they had signed up and which would be used to show the maps.

  1. What would be the best method for storing this information? Custom setting or Custom object?

  2. The api key which will be retrieved and used in the Javascript code. Now if someone does a view source of the VF page wouldnt it show the api key? Is there something that needs to done hide the key?

script type="text/javascript" src="https://maps.googleapis.com/maps/api/js?key=APIKEYqueriedfromCSorCO"> /script


The API key is not a secret, so you can store it in whatever method you like.

The important thing is that when they create the key in Google Cloud Console, they need to restrict the referrer. If they do that, it doesn't matter who knows the key, it can only be used from the specified domain(s). If the page is going to be on a SF Site, then your customer will have a unique domain. Otherwise, they'd probably better enable MyDomain for use inside normal SF.

See https://developers.google.com/maps/api-key-best-practices#restrict_apikey

| improve this answer | |
  • That makes sense – Prady Nov 26 '18 at 4:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.