How does Google Cloud Platform API key restriction for iOS apps work?

Question

According to:

https://cloud.google.com/speech/docs/common/auth

We can create an API key to a GCP resource (e.g. Google Maps, Speech, Translate) restricted by "iOS apps" to a particular bundle ID. In principle this is great, but how does GCP actually implement this? How does GCP determine the client's bundle ID since only the client is only making standard HTTP requests to GCP -- presumably it's not reporting its bundle ID in the header?

I'd like to enable this for an API key but don't want to suddenly shut down my iOS client because somehow it's not reporting its bundle ID.

Euboea

I imagine that the SDK generates a hash or a signature that includes the API key and the bundle ID and the bundle ID is also sent in the body or a header – Discounter

Answer 1

I think Google Translation API just identifies your app by value in request header key x-ios-bundle-identifier.

I tried using Postman to send a successful request with following parameters.

---

• GCP API Key config

• Postman request

Subscribe

Thx, Do we have the same way with Android? – Catty

How do you know about x-ios-bundle-identifier header requirement? It works but is it documented anywhere? Anyway such API Key restriction feels useless. How can a header protect my key from being used by another person if anyone can set the same header? – Headforemost