My site uses the Google Maps javascript API, so I'm using a "Browser key", which is plainly visible in my javascript to anyone who does "View Source".
Google's documentation on Browser keys in javascript apps (https://support.google.com/cloud/answer/6158862?hl=en&ref_topic=6262490) says: "Create and use a Browser key if your application runs on a client, such as a web browser. To prevent your key from being used on unauthorized sites, only allow referrals from domains you administer."
Unfortunately there are no instructions about how to implement what they say in that last sentence (restricting the domains for browser keys). I've been hunting around the menus and haven't been able to figure out how to do it.
The closest I've gotten is: In https://console.cloud.google.com I clicked on the hambuger and selected "API Manager," then clicked on "Credentials," clicked on the tab labeled "Domain verification." I have no idea if that's the right place to go to, but it's the only place that I found that mentions domains. While on that tab, I clicked "Add domain" and added a domain. But that didn't restrict the keys to that domain. I tested the Browser key on a different domain, and the key worked on that other domain.
Can anyone provide step-by-step instructions for how to make the Browser key only usable from one domain?