Google API Keys API
Browse all Google APIs39
AI ReadinessNon-Ready (F)39/100
Official vendor OpenAPI document · agent-readySecuritySecrets Managementoauth28 EndpointsREST
For Agents
Create, restrict, and rotate Google Cloud API keys for projects. Useful for agents that need to provision scoped credentials for unauthenticated APIs like Maps, Translate, or Cloud Vision public quotas.
Use for: Create a new API key for the maps service, Restrict an API key to a specific Android package, Rotate the API key used by our mobile app, Undelete a key that was removed by mistake
Not supported: Does not handle service account keys, OAuth client secrets, or non-Google API credentials - use for managing Google Cloud API keys and their restrictions only.
The Google Cloud API Keys API manages the API keys associated with developer projects. It exposes operations to create, retrieve, update, delete, and undelete keys, look up a key by string, and fetch the key string itself. API keys can be restricted by API target, IP address, HTTP referrer, or Android and iOS application identifiers, giving teams least-privilege credentials for unauthenticated services.
Install Jentic One Beta
Connect the API Keys API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the API Keys API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fgoogleapis.com%2Fapikeys" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fgoogleapis.com%2Fapikeys" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with API Keys API.
Create API keys scoped to specific Google APIs and clients
Restrict keys by IP, HTTP referrer, Android package, or iOS bundle
Rotate keys by creating a new key and deleting the old one
Undelete a recently deleted key within the recovery window
Look up the project and metadata for a given key string
Retrieve the actual key string for an existing key resource
Use Cases
Patterns agents use API Keys API for, with concrete tasks.
★ Scoped API key provisioning for client apps
Mobile and web teams provision API keys restricted to a specific app identifier so that even if the key is extracted from the binary, it cannot be used elsewhere. The keys.create operation accepts API targets and client restrictions in one call, replacing console clicks with reproducible scripts.
Create an API key under projects/p restricted to Android package com.example.app with SHA-1 ABC123 and limited to API target maps-android-backend.googleapis.com.
Scheduled key rotation
Security teams rotate API keys on a schedule. The agent creates a new key with the same restrictions, swaps it into the application config, then deletes the old key. The undelete endpoint provides a safety net inside the recovery window if rotation breaks something.
Create a new key cloning restrictions of key K-old, push the new key string to Secret Manager, then delete K-old.
Leaked key triage
When a key shows up in a public repo or alert, security uses keys.lookupKey to find which project owns it, then deletes it from that project. Combined with audit logs the team can identify the leak source and rotate the affected service.
Call /v2/keys:lookupKey with the suspect key string, then delete the returned key resource and post the audit log link to the incident channel.
AI agent credential lifecycle through Jentic
An AI agent acting on infra tickets handles 'rotate maps key' or 'create scoped key for new mobile build' by calling Jentic-mediated API Keys operations. The agent never holds the project's service account JSON, only short-lived scoped tokens at execution.
On ticket 'rotate maps key for android build', create a new restricted key, return its key string in an encrypted reply, and delete the previous key after the requester confirms.
Key Endpoints
8 endpoints — the google cloud api keys api manages the api keys associated with developer projects.
METHOD
PATH
DESCRIPTION
GET
/v2/keys:lookupKey
Look up the project and metadata for a key string
DELETE
/v2/{+name}
Delete an API key
GET
/v2/{+name}/keyString
Retrieve the secret key string for a key resource
POST
/v2/{+name}:undelete
Undelete a recently deleted key
GET
/v2/{+parent}/keys
List API keys under a project
GET
/v2/keys:lookupKey
Look up the project and metadata for a key string
DELETE
/v2/{+name}
Delete an API key
GET
/v2/{+name}/keyString
Retrieve the secret key string for a key resource
POST
/v2/{+name}:undelete
Undelete a recently deleted key
GET
/v2/{+parent}/keys
List API keys under a project
Jentic AI Readiness Score
This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.
A
API Keys API
- Non-Ready (F)39/100
71
Foundational Compliance56
Developer Experience & Jentic Compatibility17
AI-Readiness & Agent Experience94
Agent Usability63
Security66
AI DiscoverabilityPowered by JenticScoring Framework 1.0.0 | Scoring Engine 0.4.0
Show dimension breakdown
71
Foundational Compliance
Base layer of spec validity and structural soundness.
Grade: A-Signals: 4
84%
Lint Results
Aggregated quality score from linter diagnostics, weighted by severity.
100%
Resolution Completeness
Percentage of `$ref` references that resolve successfully.
0%
Specification Validity
Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).
100%
Structural Integrity
Structural correctness score based on schema issues using logarithmic dampening.
56
Developer Experience & Jentic Compatibility
Clarity, completeness, and ingestion readiness for developers and tooling.
Grade: CSignals: 4
0%
Example Density
How richly the API is illustrated with examples.
100%
Example Validity
Percentage of examples that conform to their schemas.
25%
Response Coverage
Percentage of operations with complete response definitions (success, client error, server error).
100%
Tooling Readiness
Health of API ingestion, bundling, and resolution within Jentic pipelines.
17
AI-Readiness & Agent Experience
Semantic breadth, depth, and agent comprehension for AI systems.
Grade: FSignals: 4
67%
Description Coverage
Coverage of descriptions across API elements.
0%
Error Standardization
Coverage of RFC 9457 Problem Details for error responses.
0%
OperationId Quality
Coverage, uniqueness, and casing consistency of operationIds for AI inference.
0%
Summary Coverage
Coverage of summaries across operations/tags/info.
94
Agent Usability
Functional utility, complexity comfort, and AI orchestration readiness.
Grade: A+Signals: 1
94%
Complexity Comfort
Agent comfort level based on API operational and structural complexity.
63
Security
Trust, risk posture, and security compliance.
Grade: B-Signals: 1
62%
Authentication Strength
Average quality of security schemes based on authentication method strength (weakest link for OAuth2).
66
AI Discoverability
Findability, semantic richness, and reasoning readiness.
Grade: BSignals: 1
66%
Descriptive Richness
Clarity and depth of descriptions across API elements.
Score it yourself
Every API in the directory is allowlisted, so you can re-score it with no key required.
npx @jentic/api-scorecard-cli score <openapi-url>Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the API Keys API by hand means setting up Google OAuth2, granting a service account the right Cloud scopes, and refreshing access tokens for each key operation yourself. Through Jentic you install once, import the API Keys API from the API Directory, store the OAuth credential once, and your agent calls it.
Permission scoping
This API puts the key resource name in the URL path (/v2/{name}/keyString, /v2/{parent}/keys), so a rule can pin your agent to one key or project: it can list keys and read a key string there and nothing else. You choose the operations it may call, so actions like deleting or undeleting a key are not included unless you add them.
Credential isolation
Your Google Cloud OAuth credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'create a restricted API key' or 'rotate an API key', and Jentic returns the matching operation with its input schema so the agent calls the right endpoint without decoding the key restriction model by hand.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using API Keys API through Jentic.
What authentication does the Google API Keys API use?
OAuth 2.0 with Google Cloud credentials. Note this is the management API for API keys themselves; the keys it produces are then used to authenticate calls to other Google APIs that accept API keys. Through Jentic, the management credentials are vaulted.
Can I restrict an API key to a single Google API?
Yes. The key resource accepts a restrictions block with apiTargets, where each target lists the service name (e.g. translate.googleapis.com) and optional methods. Calls to other services with that key will be rejected.
What are the rate limits for the Google API Keys API?
Standard Google Cloud per-project per-minute quotas apply to management calls. Key rotations are infrequent operations; the data-plane quota of services authenticated by the key is enforced separately by each target service.
How do I create a restricted API key through Jentic?
Search Jentic for 'create google API key', load the schema for the keys.create operation, and execute it with the parent project, displayName, and restrictions block (apiTargets plus client restriction). Jentic returns the operation handle to poll until done.
Is the Google API Keys API free?
Yes. Managing API keys carries no separate fee. Costs accrue only when the keys are used to call paid services like Maps, Translate, or Vision.
Can I recover a deleted API key?
Yes, within the recovery window. Call /v2/{+name}:undelete on the deleted key resource. After the recovery window the key is purged and cannot be restored; create a new key instead.
Can I limit what my agent is allowed to do with the Google API Keys API?
Yes. Because you self-host Jentic One and write the rules yourself, you decide which operations the agent may call and which credential it uses, and this API puts the key resource name in the URL path (like /v2/{parent}/keys and /v2/{name}/keyString) so a rule can pin the agent to a single project or key. For example, you can allow it to list keys and read a key string for one project while excluding everything else. Destructive operations such as deleting or undeleting a key are not available to the agent unless you explicitly add them. Your Google Cloud OAuth credential is injected at execution time and never enters the agent's prompt or logs.
GET STARTED