API keys should allow use only by specified hosts and apps
Unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API key usage to trusted hosts, HTTP referrers and apps.
Unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides.
What this control checks
API keys must be restricted to use by only specified Hosts and Apps.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.iam_api_key_restricts_websites_hosts_apps.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.AA-01 (Identities and credentials for authorized users, services, and hardware are managed by the organization.), PR.AA-03 (Users, services, and hardware are authenticated.) and PR.AA-05 (Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and...).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-03
- PR.AA-05
- 1.13 Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps
- 1.13 Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps
- 1.13 Ensure API keys are restricted to use by only specified Hosts and Apps
- 1.13 Ensure API keys are restricted to use by only specified Hosts and Apps
- 1.13 Ensure API keys are restricted to use by only specified Hosts and Apps
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_api_key_restricts_websites_hosts_apps - Powerpipe Control:
gcp_compliance.control.iam_api_key_restricts_websites_hosts_apps
Last reviewed: 2026-10-09