Show HN: Catch abnormal usage of your API keys on Google Cloud
This codelab shows how to detect rogue or compromised API keys on Google Cloud by auditing usage, spotting abnormal spikes, and automating blocking of potentially exposed keys to improve API key hygiene.
Background
- This is a Google Cloud "codelab" (a self-guided, hands-on tutorial) aimed at developers using Google's AI services like Gemini. It addresses a practical security problem: by default, API keys are a simple string, and if someone steals or leaks one (e.g., in a public GitHub repo or an app binary), they can use it to run up your bill or abuse the service on your dime.
- The article references an earlier Cloud Blog post that gave general advice on "key hygiene" (rotating keys, restricting permissions). This codelab provides actual scripts to detect abnormal usage patterns (spikes, activity from unexpected geographies) and automatically revoke compromised keys.
- For context: Google Cloud, Amazon Web Services (AWS), and other cloud platforms all struggle with this — developers hard-code keys, bots scrape them, and attackers exploit them. The main audience is engineers who build apps using Google's AI APIs (Gemini, Vertex AI, etc.) and need operational guardrails beyond the default security settings.