Google API Keys Weren’t Secrets—Until Gemini Broke Everything

Google API Keys Weren't Secrets—Until Gemini Broke Everything Google spent fifteen years telling developers that API keys aren't secrets. Their documentation literally instructs you to paste them into HTML. Firebase's security checklist explicitly states it. Maps JavaScript tutorials show it as best practice. Then Gemini dropped and retroactively turned two decades of following instructions into a security disaster. Here's the thing: Google Cloud uses a single key format (the AIza... prefix) for two completely different purposes: public project identification and sensitive API authentication. When the Gemini API gets enabled on a project, every API key in that project—including the ones you embedded in client-side code years ago—silently gains access to private Gemini endpoints. No warning. No email. No opt-in. I've been saying "keys are not credentials" for years. That's the whole point of Google's design: API keys are for billing and routing, not secrets. But Gemini fundamentally bro