Protecting YouTube v3 API key in a client-side application

Question

I\'m looking at the following guide: https://developers.google.com/youtube/v3/getting-started

The first step of interacting with YouTube\'s API is:

Answer 1

Don't think it is a malicious user. I think something's wrong on YouTube's side, since I'm seeing exactly the same issue with API requests made from my app

Answer 2

That is correct. When you make your key make sure you use the REFERERS so that even if they do get your key it will not work for them!

Answer 3

It appears to be a major bug. Same problem here - quota usage spiked like crazy starting on Sept. 3 and requests now cost WAY more than the documentation states.

Someone reported it as a defect in their bug tracking system. I suggest everyone affected go there and star the defect to help call attention to it:

• https://code.google.com/p/gdata-issues/issues/detail?id=6623&q=label%3AAPI-YouTube&sort=-id&colspec=API%20ID%20Type%20Status%20Priority%20Stars%20Summary

Answer 4

I propose the following ideas:

• You can make sure the user accessing your page is a human (with Captcha, etc.)
• Hide your API call behind an AJAX call that is triggered by your front-end (like GET /callgoogleapi);
• The handler of AJAX call can set a frequency threshold, i.e. 2 requests per second. If too fast, the API call is not made, and AJAX replies a message like "User operation too fast".

Answer 5

We also see this error, it seems to be too large deviations. results Overview is 813.844, but the APIs are Used 49,379,348 of 50,000,000 requests today

Answer 6

This was due to a quota cost increase, it's temporarily reverted. We'll announce cost changes in http://apiblog.youtube.com/ and https://developers.google.com/youtube/v3/revision_history going forward.