• Resolved Piyush Patel

    (@piyushpatel123)


    Hello,

    API keys with referrer restrictions cannot be used with this API.

    The site is using the Listify theme.

    Array
    (
    [headers] => WpOrg\Requests\Utility\CaseInsensitiveDictionary Object
    (
    [data:protected] => Array
    (
    [content-type] => application/json; charset=UTF-8
    [date] => Wed, 25 Jun 2025 12:24:07 GMT
    [pragma] => no-cache
    [expires] => Fri, 01 Jan 1990 00:00:00 GMT
    [cache-control] => no-cache, must-revalidate
    [access-control-allow-origin] => *
    [content-security-policy-report-only] => script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/msaifdggmnwc:228:0
    [cross-origin-opener-policy-report-only] => same-origin; report-to=msaifdggmnwc:228:0
    [report-to] => {"group":"msaifdggmnwc:228:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/msaifdggmnwc:228:0"}],}
    [server] => mafe
    [content-length] => 142
    [x-xss-protection] => 0
    [x-frame-options] => SAMEORIGIN
    [server-timing] => gfet4t7; dur=46
    [alt-svc] => h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    )

    )

    [body] => {
    "error_message" : "API keys with referer restrictions cannot be used with this API.",
    "results" : [],
    "status" : "REQUEST_DENIED"
    }
    [response] => Array
    (
    [code] => 200
    [message] => OK
    )

    [cookies] => Array
    (
    )

    [filename] =>
    [http_response] => WP_HTTP_Requests_Response Object
    (
    [response:protected] => WpOrg\Requests\Response Object
    (
    [body] => {
    "error_message" : "API keys with referer restrictions cannot be used with this API.",
    "results" : [],
    "status" : "REQUEST_DENIED"
    }
    [raw] => HTTP/1.1 200 OK
    Content-Type: application/json; charset=UTF-8
    Date: Wed, 25 Jun 2025 12:24:07 GMT
    Pragma: no-cache
    Expires: Fri, 01 Jan 1990 00:00:00 GMT
    Cache-Control: no-cache, must-revalidate
    Access-Control-Allow-Origin: *
    Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/msaifdggmnwc:228:0
    Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=msaifdggmnwc:228:0
    Report-To: {"group":"msaifdggmnwc:228:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/msaifdggmnwc:228:0"}],}
    Server: mafe
    Content-Length: 142
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    Server-Timing: gfet4t7; dur=46
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Connection: close

    {
    "error_message" : "API keys with referer restrictions cannot be used with this API.",
    "results" : [],
    "status" : "REQUEST_DENIED"
    }
    [headers] => WpOrg\Requests\Response\Headers Object
    (
    [data:protected] => Array
    (
    [content-type] => Array
    (
    [0] => application/json; charset=UTF-8
    )

    [date] => Array
    (
    [0] => Wed, 25 Jun 2025 12:24:07 GMT
    )

    [pragma] => Array
    (
    [0] => no-cache
    )

    [expires] => Array
    (
    [0] => Fri, 01 Jan 1990 00:00:00 GMT
    )

    [cache-control] => Array
    (
    [0] => no-cache, must-revalidate
    )

    [access-control-allow-origin] => Array
    (
    [0] => *
    )

    [content-security-policy-report-only] => Array
    (
    [0] => script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/msaifdggmnwc:228:0
    )

    [cross-origin-opener-policy-report-only] => Array
    (
    [0] => same-origin; report-to=msaifdggmnwc:228:0
    )

    [report-to] => Array
    (
    [0] => {"group":"msaifdggmnwc:228:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/msaifdggmnwc:228:0"}],}
    )

    [server] => Array
    (
    [0] => mafe
    )

    [content-length] => Array
    (
    [0] => 142
    )

    [x-xss-protection] => Array
    (
    [0] => 0
    )

    [x-frame-options] => Array
    (
    [0] => SAMEORIGIN
    )

    [server-timing] => Array
    (
    [0] => gfet4t7; dur=46
    )

    [alt-svc] => Array
    (
    [0] => h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    )

    )

    )

    [status_code] => 200
    [protocol_version] => 1.1
    [success] => 1
    [redirects] => 0
    [url] => https://maps.googleapis.com/maps/api/geocode/json?key=AIzaSyARZ7NTl_4jLLxDzwUds5O0yhkueruQYkY&address=759%2Bstate%2Bpark%2Broad%2Btroutman%2Bnc%2B28166&language=en
    [history] => Array
    (
    )

    [cookies] => WpOrg\Requests\Cookie\Jar Object
    (
    [cookies:protected] => Array
    (
    )

    )

    )

    [filename:protected] =>
    [data] =>
    [headers] =>
    [status] =>
    )

    )

    Currently, I’ve set the Application restrictions to None because we want to display the map on the website.
    See the screenshot: https://prnt.sc/QerNb-UyM5t-

    Please check and let me know what the issue was.

    The page I need help with: [log in to see the link]

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Contributor Dan (a11n)

    (@drawmyface)

    Hi @piyushpatel123

    Since WP Job Manager calls the Geocoding API from the backend/server (PHP), it has no referrer, so Google will block it if you’re using a Google Maps API key with “HTTP referrer (websites)” restrictions, which only work for frontend (JavaScript in browser) requests.

    You can either keep the restrictions set to None, or you can set it to IP Address and enter your server IP (although you may need to request a static IP if you currently have a dynamic one that changes frequently).

    Sharing some feedback as I am in the similar situation and hopefully help anyone that stumbles across this.

    Google Maps API restrictions won’t pass their checks if you are geocoding on the frontend and require HTTP referrer (websites) method for any frontend API interactions with their API. If you are solely using the WordPress admin, you may restrict to your server’s IP address or a range of IP addresses if you do not have a static IP address.

    The following solutions you may use (as mentioned above):

    1. (Easiest) Set the restrictions to none, and rotate your keys ever so often in Google Maps API to prevent leaked keys from being abused.
    2. Use restrictions as mentioned above. If you’re only geocoding in the backend us IP restrictions and if you’re only using the frontend use HTTP restrictions.
    3. Load 2 API keys with each restriction for the relevant action if filters are available to swap out keys as needed. One for the backend and One for the frontend (not ideal).

    Hopefully Google will consider making multi-restriction types available.

    Plugin Contributor Dan (a11n)

    (@drawmyface)

    @andrewza Thanks for sharing!

Viewing 3 replies - 1 through 3 (of 3 total)

You must be logged in to reply to this topic.