# Load googlemaps api from backend to avoid exposing key

**URL:** <https://community.weweb.io/t/load-googlemaps-api-from-backend-to-avoid-exposing-key/7419>\
**Category:** How do I?\
**Tags:** xano, google-maps\
**Created:** [March 5, 2024, 7:39pm UTC](https://community.weweb.io/t/load-googlemaps-api-from-backend-to-avoid-exposing-key/7419 "2024-03-05T19:39:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![SOT](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@SOT](https://community.weweb.io/u/SOT)\
**Post date:** [March 5, 2024, 7:39pm UTC](https://community.weweb.io/t/load-googlemaps-api-from-backend-to-avoid-exposing-key/7419/1 "2024-03-05T19:39:44Z")

</div>

Hi there,  
I am using a custom JS code to display a map with various pointer and calculations thanks to a tutorial from @raydeck that has proven very useful

The current issue I am having is that I need to run the following JS commands on page load which expose my google API key:

doc = document.createElement(‘script’);  
doc.src = ‘[https://maps.googleapis.com/maps/api/js?key=[xxxx]&channel=1&sensor=false&libraries=geometry](https://maps.googleapis.com/maps/api/js?key=%5Bxxxx%5D&channel=1&sensor=false&libraries=geometry)’;  
document.body.appendChild(doc);

How could I convert the following function to request the script from the backend and hide the API key ?

Thanks in advance for your help

---

<div class="post-metadata">

**Author:** ![andreas](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/andreas/32/7349_2.png) [@andreas](https://community.weweb.io/u/andreas)\
**Post date:** [March 5, 2024, 8:44pm UTC](https://community.weweb.io/t/load-googlemaps-api-from-backend-to-avoid-exposing-key/7419/2 "2024-03-05T20:44:14Z")

</div>

As far as I know this Google Maps key is a public key. Google gives you the possibility to restrict your key in their console. That’s the way to make sure your key isn’t abused.

---

<div class="post-metadata">

**Author:** ![SOT](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@SOT](https://community.weweb.io/u/SOT)\
**Post date:** [March 5, 2024, 11:13pm UTC](https://community.weweb.io/t/load-googlemaps-api-from-backend-to-avoid-exposing-key/7419/3 "2024-03-05T23:13:09Z")

</div>

Thanks @andreas, that was easy enough 😀  
That’s all fixed now