Rotate a leaked Google Maps API key without downtime
A Maps key in front-end code is public by design — the protection is restrictions, not secrecy. Rotate in this order and your map never goes grey.
How to tell this is your problem
- Usage spikes that don’t match your traffic.
- Google security notice about an exposed key.
- The key appears in a public repository or a third-party script.
Why it happens
Deleting first, then replacing, guarantees an outage window. Creating and restricting the replacement before the swap removes it.
The fix, step by step
- 01Create a new key and immediately apply the same website and API restrictions as the old one.
- 02Deploy the new key to every place the old one is used — theme settings, plugins, server-rendered templates.
- 03Watch the metrics graph for the old key until it flatlines, usually a few hours.
- 04Delete the old key only once it shows zero requests.
Confirm it is fixed
Scan each page that has a map. Any page still calling the old key will show a MissingKeyMapError or InvalidKeyMapError once it is deleted.
Check whether this is your error
A scan tells you in about twelve seconds, from a clean session.