The summary.
RESTRICT EVERY KEY, WITHOUT EXCEPTION
A key in a public page is visible to everyone, and unrestricted keys are scraped and used at your cost.
Restrict by origin and by which APIs the key may call, and use separate keys per platform and purpose.
QUOTAS ARE THE ONLY HARD STOP
Budgets alert but do not prevent. Set daily quotas below what a runaway would consume.
USE SESSION TOKENS FOR AUTOCOMPLETE AND FIELD MASKS FOR DETAILS
Without them, every keystroke is billed and every detail request costs far more than needed.
The matrix service is billed by origins multiplied by destinations, which grows fast.
USE STATIC MAP IMAGES WHERE INTERACTION IS UNNECESSARY
Interactive maps are heavy in download and data, which the visitor pays for.
GEOCODING IS APPROXIMATE, PARTICULARLY HERE
Show the result and let the user confirm it. Store both the coordinates and the text they entered, and capture landmarks — that is how people actually describe locations.
ALWAYS PROVIDE THE ADDRESS AS TEXT ALONGSIDE A MAP
A map is not usable by everyone; a text address always is.
