Understand Google Maps API-key errors and restrictions
Open DevTools → Console and locate the first message containing Google Maps JavaScript API error. The code identifies which Google Cloud control failed.
| Console code or symptom | Meaning | Fix |
|---|---|---|
MissingKeyMapError | Maps loader has no key | Save the browser key under Settings → Map and clear caches |
InvalidKeyMapError | Google cannot find the key | Copy the complete current key from the correct Cloud project |
ExpiredKeyMapError | Key expired or is not recognized | Wait briefly for a new key to propagate or replace the expired key |
ApiNotActivatedMapError | Maps JavaScript API is disabled | Enable Maps JavaScript API in the key's project |
ApiTargetBlockedMapError | API restrictions exclude the requested service | Permit Maps JavaScript API and any required Places/Static service |
BillingNotEnabledMapError / ClientBillingNotEnabledMapError | Project has no active billing | Attach/enable billing for the same project |
RefererNotAllowedMapError | Current website origin is absent from Website restrictions | Add exact HTTP/HTTPS production, staging, and local origins as needed |
OverQuotaMapError | Project/key exceeded a quota | Inspect quotas and usage in Google Cloud; do not simply remove restrictions |
| Dark watermarked map | Usually key or billing failure | Find the accompanying console code and fix that condition |
Browser key versus server key
Cliq Store Locator intentionally has two fields:
- Browser key loads Maps JavaScript plus
places,markerlibraries and is visible in page source. Restrict by Websites. - Server key is used by server-side Google geocoding for imports and Fill missing coordinates. Keep it private and restrict by server IP plus Geocoding API.
Using one heavily restricted key for both commonly causes either the frontend map or server geocoding to fail.
Local and staging domains
Website restrictions must cover the origin used in the browser. Add entries for production and each legitimate staging/local HTTP(S) host. Ports matter for local testing. Avoid authorizing * globally; Google recommends separate keys per application and restrictions appropriate to each key.
After changing Cloud settings, allow propagation time, purge page/CDN optimization caches, open a private window, and reload the exact failing URL.